diff --git a/po/af.po b/po/af.po
index daff0751..7594f48c 100644
--- a/po/af.po
+++ b/po/af.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Afrikaans (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/am.po b/po/am.po
index 372adea9..5d732c21 100644
--- a/po/am.po
+++ b/po/am.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Amharic (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ar.po b/po/ar.po
index 5d7ed6d0..9b9e8163 100644
--- a/po/ar.po
+++ b/po/ar.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Arabic (http://www.transifex.com/projects/p/meego/language/"
@@ -174,7 +174,7 @@ msgstr "طلب لكلمة المرور ولكن '- لايوجد كلمة مرو
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -301,541 +301,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -937,6 +876,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -957,7 +987,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -976,7 +1006,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -985,485 +1015,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1657,7 +1691,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1675,235 +1709,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1916,407 +1950,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2324,173 +2371,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2498,89 +2552,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "خيار المصادقة  \"%s\" غير متاح\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2595,16 +2660,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2670,7 +2735,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2802,501 +2867,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3593,83 +3767,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/as.po b/po/as.po
index 68bc997d..ce1fe134 100644
--- a/po/as.po
+++ b/po/as.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: network-manager-openconnect master\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-03-14 18:02+0000\n"
 "Last-Translator: Nilamdyuti Goswami <ngoswami@redhat.com>\n"
 "Language-Team: Assamese <kde-i18n-doc@kde.org>\n"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ast.po b/po/ast.po
index cd3dbcfd..fb711613 100644
--- a/po/ast.po
+++ b/po/ast.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Asturian <alministradores@softastur.org>\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/az.po b/po/az.po
index 5f0d1689..c53f2df7 100644
--- a/po/az.po
+++ b/po/az.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Azerbaijani (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/be.po b/po/be.po
index 11af536a..e05cc4a5 100644
--- a/po/be.po
+++ b/po/be.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Belarusian (http://www.transifex.com/projects/p/meego/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/bg.po b/po/bg.po
index 9b893e7e..f8371b1f 100644
--- a/po/bg.po
+++ b/po/bg.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: network-manager-openconnect master\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-02-17 06:32+0200\n"
 "Last-Translator: Krasimir Chonov <mk2616@abv.bg>\n"
 "Language-Team: Bulgarian <dict@fsa-bg.org>\n"
@@ -173,7 +173,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -300,541 +300,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -936,6 +875,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -956,7 +986,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -975,7 +1005,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -984,485 +1014,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1656,7 +1690,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1674,235 +1708,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1915,407 +1949,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2323,173 +2370,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2497,89 +2551,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2594,16 +2659,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2669,7 +2734,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2801,501 +2866,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3592,83 +3766,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/bg_BG.po b/po/bg_BG.po
index 38fc11fd..aaec9723 100644
--- a/po/bg_BG.po
+++ b/po/bg_BG.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Bulgarian (Bulgaria) (http://www.transifex.net/projects/p/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/bn.po b/po/bn.po
index b26edfbe..ff05c709 100644
--- a/po/bn.po
+++ b/po/bn.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Bengali (http://www.transifex.net/projects/p/meego/team/bn/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/bn_IN.po b/po/bn_IN.po
index 60b160ba..b08bf531 100644
--- a/po/bn_IN.po
+++ b/po/bn_IN.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Bengali (India) (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/br.po b/po/br.po
index 66bedf89..2c5d01e9 100644
--- a/po/br.po
+++ b/po/br.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Breton (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/bs.po b/po/bs.po
index 578ee9cc..913c9a13 100644
--- a/po/bs.po
+++ b/po/bs.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Bosnian (http://www.transifex.net/projects/p/meego/team/bs/)\n"
@@ -174,7 +174,7 @@ msgstr "Upitan za šifru ali '--nema-šifre' postavi\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Ne preuzima se XML profil jer SHA1 već odgovara\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Neuspjeh pri otvaranju HTTPS konekcije na %s\n"
@@ -308,553 +308,484 @@ msgstr "(Greška prilikom opisivanja greške!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "GREŠKA: Ne može inicijalizirati utičnice\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "KRITIČNA GREŠKA: DTLS master tajna nije inicijalizovana. Molimo, prijavite "
 "ovo.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Greška kreirajući HTTPS CONNECT zahtjev\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Greška fetching HTTPS odgovor\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN servis nedostupan; razlog: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Ima neprikladan HTTP CONNECT odgovor: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Ima CONNECT odgovor: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Nema memorije za opcije\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID nema 64 karaktera; je: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Nepoznat DTLS-Content-Encoding %s\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Nepoznati CSTP-Sadržaj-Kodiran %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Nema MTU prijema. Ukidanje\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Nije IP adresa primljena. Ukidanje\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Primljeno je IPv6 podešavanje ali MTU %d je premali.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Ponovno konektovanje daje drugačiju IP adresu (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Ponovno konektovanje daje drugačiju IP netmask (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Ponovno konektovanje daje drugačiju IPv6 adresu  (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Ponovno konektovanje daje drugačiju IPv6 netmask (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP konektovan. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP komplet šifrera: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Instalacija sažimanja neuspjela\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Alokacija deflate bafera neuspjela\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "podizanje neuspjelo\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "LZS dekompresija neuspjela: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "LZ4 dekompresija neuspjela\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Nepoznat tip kompresije %d\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Primljen %s kompresovan paket podataka od %d bajta (bilo %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "deflate neuspio %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Nije uspjela raspodela\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Primljen je kratak paket (%d bajta)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Ne očekivani paket dužine. SSL_čita vraćeni %d ali paket je\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Ima CSTP DPD zahtjev\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Ima CSTP DPD odgovor\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Ima CSTP Keepalive\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Primljen ne kompresovan paket podataka od %d bajta\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Primljeni server odspojen: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Primljeni server odspojen\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Kompresovani paket primljen u !deflate režim\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "primljeni server završava paket\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Nepoznati paket  %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL napisao premalo bajta! Upitan za %d, poslano %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP rekey due\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Rehandshake nije uspio; pokušavanje novi-tunel\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTP Dead Peer Detection detektovan dead peer!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Ponovna konekcija neuspjela\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Pošalji CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Pošalji CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Slanje kompresovanog paketa podataka od %d bajta (bilo je %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Slanje ne kompresovanog paketa podataka od %d bajta\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Poslan BYE paket: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Pokušavanje Digest autentifikacije za proxy\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Pokušana Digest prijava na server '%s'\n"
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr "Neuspjelo  kreirati SSL_SESSION ASN.1 za OpenSSL: %s\n"
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr "OpenSSL neuspio analizirati SSL_SESSION ASN.1\n"
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Postavljanje DTLSv1 sesije neuspjelo\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Postavljanje DTLSv1 CTX neuspjelo\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Postavljanje DTLS šifre neuspjelo\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Nije precizirana jedna DTLS šifra\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"Seje http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Usi the --no-dtls command linije option to avoid this message\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "Osnovana DTLS veza (pomoću OpenSSL). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Tvoj OpenSSL je stariji od ovog kojeg si napravio ponovo, pa DTLS možda neće "
-"uspjeti!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "Za DTLS spajanje vrijeme isteklo\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Ovo je možda zato što tvoj OpenSSL je pukao\n"
-"Pogledaj http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS spajanje neuspjelo: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Nepoznati DTLS parametri za zahtjevani CipherSuite '%s'\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Neuspjeh pri postavljanju DTLS prioriteta: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Neuspjeh pri postavljanju DTLS sesije parametara: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Neuspjeh pri postavljanju DTLS MTU: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Osnovana DTLS veza (pomoću GnuTLS). Ciphersuite %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "DTLS spajanje neuspjelo: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(Da li vas mrežna barijera sprečava da pošaljete UDP pakete?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "DTLS veza je pokušana biti ostvarena sa postojećim fd\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Nema DTLS adrese\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Server ponudio nema DTLS opcija o šifri\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Nema DTLS kada je konektovan putem proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS opcija %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS postavljen. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Pokušaj novu DTLS konekciju\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Primljen DTLS paket  0x%02x of %d bajta\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Ima DTLS DPD zahtjev\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Ne moguće poslati DPD odgovor. Očekuj odspajanje\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Ima DTLS DPD odgovor\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Ima DTLS Keepalive\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Kompresovani DTLS paket primljen kada kompresija nije bila omogućena\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Nepoznati DTLS paket tipa %02x, lijen %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS rekey due\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "DTLS Rehandshake nije uspio; ponovna konekcija.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS Dead Peer Detection detektovan dead peer!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Pošalji DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Ne moguće poslati DPD zahtjev. Očekuj odspajanje\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Pošalji DTLS Keepalive\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Ne moguće poslati keepalive zahtjev. Očekuj odspajanje\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Nepoznat paket (lijen %d) primljen: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS je napisao grešku %d. Vraća se na SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS je napravo grešku: %s. Vraća se na SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Poslan DTLS paket od %d bajta; DTLS poslao vraćeni %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgstr ""
+
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Timeout while waiting for DPD response; trying %d\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
+
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr "Prihvatam očekivani ESP paket sa seq %u\n"
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Odbacujem stari ESP paket s seq %u (očekivano %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr ""
+"Prihvatam kasnije od očekivanog ESP paket sa seq %u (očekivano %<PRIu64>)\n"
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Prihvatam prekoredni ESP paket sa seq %u (očekivano %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Odbacujem stari ESP paket s seq %u (očekivano %<PRIu64>)\n"
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr "Odbacujem ponovljeni ESP paket sa seq %u\n"
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr ""
-"Prihvatam kasnije od očekivanog ESP paket sa seq %u (očekivano %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Prihvatam prekoredni ESP paket sa seq %u (očekivano %<PRIu64>)\n"
 
 #: esp.c:68
 #, c-format
@@ -955,6 +886,97 @@ msgstr "Neuspjelo poslati ESP paket: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Poslan ESP paket od %d bajta\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Nepoznati DTLS parametri za zahtjevani CipherSuite '%s'\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Neuspjeh pri postavljanju DTLS prioriteta: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Neuspjeh pri postavljanju DTLS sesije parametara: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Neuspjeh pri postavljanju DTLS MTU: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Osnovana DTLS veza (pomoću GnuTLS). Ciphersuite %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "Za DTLS spajanje vrijeme isteklo\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "DTLS spajanje neuspjelo: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(Da li vas mrežna barijera sprečava da pošaljete UDP pakete?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -975,7 +997,7 @@ msgstr "Neuspjelo  generisati slučajne ključeve za ESP: %s\n"
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr "Neuspjelo izračunati HMAC za ESP paket: %s\n"
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr "Primljen ESP paket s neispravnim HMAC\n"
 
@@ -994,7 +1016,7 @@ msgstr "Neuspjelo generisati ESP paket IV: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Neuspjelo šifrovanje ESP paketa: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL pisanje otkazano\n"
 
@@ -1003,487 +1025,491 @@ msgstr "SSL pisanje otkazano\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Ne može upisati u SSL soket: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL čitanje otkazano\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "SSL utičnica je zatvorena neispravno\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Ne može pročitati iz SSL soketa: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "SSL očitao grešku: %s; ponovno konektovanje.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "SSL poslao nespjeh: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Ne može izvući vrijeme isteka od certifikata\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Certifikat klijenta je istekao"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Certifikat klijenta istice uskoro"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Ne može učitati predmet '%s' iz keystore: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Ne može otvoriti kljč/certifikat datoteku %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Nije uspio stat ključ/certifikat datoteka %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Neuspjeh pri alociranju bafera certifikata\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Ne može učitati certifikat u memoriju: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Ne može instalirati PKCS#12 podatkovnu strukturu: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Ne može dešifrirati PKCS#12 certifikat datoteku\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Unesi PKCS#12 prolaznu frazu:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Ne može procesuirati PKXS#12 datoteku: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Ne može učitati PKCS#12 certifikat: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Ubacivanje X509 certifikata neuspjelo: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Postavljanje PKCS#12 certifikata neuspjelo: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Ne može pokrenuti MD5 sastav: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "MD5 hash greška: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Nedostaje DEK-infor: zaglavlje iz OpenSSL šifrovanog ključa\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Ne može odrediti PEM Šifrovani tip\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Ne podržan PEM šifrovani tip: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Neispravna salt u šifrovanim PEM datotekama\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Greška base64-dešifriranje šifrovanih PEM datoteka: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Šifrovane PEM datoteke prije male\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Ne može pokrenuti šifru za dešifriranje PEM datoteka: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Neuspjeh pri dešifrovanju PEM datoteka: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Dešifrovanje PEM ključa neuspjelo\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Unesi PEM prolaznu  frazu:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Ova izvršna je izgrađena bez podrške ključa sistema\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Ova binarna datoteka je izgrađena bez podrške za PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Korsti PKCS#11 certifikat %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "Koristim sistemsko uvjerenje „%s“\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Greška pri učitavanju certifikata iz PKXS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Greška učitavanja sistemskog uvjerenja: %s\n"
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Koristi certifikat datoteka %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "PKCS#11 datoteka ne sadrži certifikat\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Nije pronađen certifikat u datoteci"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Učitavanje certifikata neuspjelo: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "Koristim sistemski ključ „%s“\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Greška pri pokretanju privatne ključ strukture: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Greška uvoza sistemskog ključa „%s“: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "Pokušavam adresu PKCS#11 ključa „%s“\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Greška pri pokretanju PKCS#11 ključ strukture: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Greška pri unosu PKCS#11 URL %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Koristi PKCS\"11 ključ %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Greška pri unosu PKCS#11 ključa u privatnu ključ strukturu: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Koristi privatnu ključ datoteku %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Ova verzija OpenConnect je napravljena bez podrške za TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Neuspjeh pri prevođenju PEM datoteke\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Neuspjeh pri učitavanju PKCS#1 privatnog ključa: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Neuspjeh pri učitavanju privatnog ključa kao PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Neuspjeh pri dešifriranju PKCS#8 certifikat datoteke\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Ne može utvrditi tip privatnog ključa %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Unesi PKCS#8 prolaznu frazu:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Ne može dobiti ključ ID: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Greška pri popisivanju podataka sa privatnim ključem: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Greška pri ovjeravanju potpisa protiv certifikata: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Nije pronađen SSL certifikat za usporedbu privatnog ključa\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Koristi klijent certifikat '%s'\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Postavljanje certifikata na opozivu listu neuspjelo: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Nije uspjela alokacija memorije za potvrdu\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "UPOZORENJE: GnuTLS vraćen pogrešan izdavateljski  certs; ovjera možda "
 "neuspjela!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "Dobijena sljedeća CA '%s' iz PKCS11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Neuspjeh pri alociranju memorije za podršku certifikatima\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Dodavanje podrške CA '%s'\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Postavljanje certifikata neuspjelo: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Server predstavljen bez certifikata\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Greška pri pokretanju X509 cert strukture\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Greška pri unosu server cert\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Ne mogu da izračunam heš serverskog uverenja\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Greška pri provjeri statusa server certifikata\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certifikat opozvan"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "potpisnik nije pronađen"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "potpisnik nije CA certifikat"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "nesiguran algoritam"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certifikat nije još aktiviran"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certifikat istekao"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "neuspješna verifikacija potpisa"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certifikat nema odgovarajući hostname"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Ovjera server certifikata neuspjela: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Neuspješna alokacija memorije za cafile certs\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Neuspješno učitavanje certifikata iz cafalie: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Neuspješno otvaranje CA datoteke '%s': %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Učitavanje certifikata neuspjelo. Zatvaranje.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL pregovara sa %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL povezivanje otkazano\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL konekcija neuspjela: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS non-fatal return during handshake: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Povezan na HTTPS na %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Reprogramirani SSL na %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN zahtjeva %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Pogrešan PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Ovo je zadnji pokušaj prije zaključavanja!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Samo još nekoliko pokušaja preostalo prije zaključavanja!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Unesi PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Nepodržan OATH HMAC algoritam\n"
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Neuspjelo izračunati OATH HMAC: %s\n"
@@ -1677,7 +1703,7 @@ msgstr "Pokušavanje HTTP Basic autentičnosti za proxy\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Pokušana HTTP Basic prijava na server '%s'\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Ova verzija OtvoreneKonekcije je izgrađena bez GSSAPI podrške\n"
 
@@ -1695,236 +1721,236 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Nema više metoda autentičnosti za isprobavanje\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Nedostatak memorije za alokaciju cookies\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Nemoguće rasčlaniti HTTP odgovor '%s'\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Ima HTTP odgovor: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Greška pri procesiranju HTTP odgovora\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ignorisanje nepoznatih HTTP odgovora reda '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Ne validan cookie ponuđen: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL ovjera certifikata neuspjela\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Odgovor tijelo ima negativnu veličini (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Nepoznat Transfer-Encoding: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP tijelo %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Greška učitavanja HTTP odgovora tijela\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Greška u dijelu zaglavlja\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Greška HTTP odgovor tijela\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Greška u chunked dekodiran. Očekivan \",got: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Ne može primiti HTTP 1.0 oblik bez zatvaranja konekcije\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Nemoguće rasčlaniti preusmjereni URL '%s': %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Ne može pratiti preusmjerenje na non-https URL '%s'\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Alociranje nove putanje za relativno preusmjerenje neuspjelo: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Neočekivan %d rezultat od servera\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "zahtjev odobren"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "opšta greška"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "konekcija nije dopuštena od strane rulset"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "mreža je nedostupna"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "računar domaćin je nedostupan"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "konekcija odbijena od strane domaćina"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL istekao"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "komandan nije podržana/protokol greška"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "tip adrese nije podržan"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr "SOCKS server zahtijeva korisničko ime/lozinku, ali nema ništa\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "Korisničko ime i lozinka za SOCKS autentifikaciju mora biti < 255 bajta\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Greška pisanja auth ahtjev za SOCKS proxy: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Greška ulitavanja auth odgovor od SOCKS proxy: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Neočekivan auth odgovor od SOCKS proxy:  %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Autentifikovano za SOCKS server koristeći lozinku\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Autentifikacija lozinkom za SOCKS server nije uspjela\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "SOCKS server zahtijeva GSSAPI autentifikaciju\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "SOCKS server zahtijeva autentifikaciju lozinkom\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "SOCKS server zahtijeva autentifikaciju\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "SOCKS server traži nepoznatu autentifikaciju tipa %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Zahtjeva SOCKS proxy konekciju za %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Greška pisanja konekcija zahtjeva SOCKS proxy: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Greška učitavanja konekcije odgovor od SOCKS proxy: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Neočekivana konekcija odgovor od SOCKS proxy: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS proxy greška %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS proxy greška %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Neočekivana adresa tipa %02x  u SOXKS konekcije odgovor\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Zahtjeva HTTP proxy konekciju za %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Slanje proxy zahtjeva neuspjelo: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Proxy CONNECT zahtjev nije uspio: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Nepoznat proxy tip '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Samo http ili soket(5) proxies podržani\n"
 
@@ -1937,45 +1963,62 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Izgradi ponovno SSL biblioteku bez Cisco DTLS podrške\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Ne može se analizirati server URL '%s'\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Samo https:// dozvoljeni za server URL\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Nema forma handler; ne može potvrditi.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr "Nije uspjela funkcija linije naredbi u argument: %s\n"
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr "Fatalna greška u rukovanju komandnom linijom\n"
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "Nije uspjela funkcija čitanja konzole: %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Greška pretvaranja ulaza konzole: %s\n"
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Alokacija neuspjela za string iz stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1984,25 +2027,21 @@ msgstr ""
 "Za pomoć pri OtvorenojKonekciji, molimo pogledajte web stranicu\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Koristi OpenSSl. Odlike predstavljen:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Koristi GnuTLS. Odlike predstavljene:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL ENGINE nije prikazan"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "koristi OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2011,31 +2050,31 @@ msgstr ""
 "\n"
 "UPOZORENJE: Nema DTLS podrške u binarnoj. Performanse ci biti smanjene.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Ne može se obraditi ovaj izvršni put \"%s\""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Alokacija za vpnc-script put nije uspjela\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Upotreba: openconnect [opcije]<server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2044,306 +2083,306 @@ msgstr ""
 "Otvori klijenta za Cisco AnyConnect VPN, verzija %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Pročitaj opcije iz config datoteke"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Nastavi u pozadini poslije podizanja"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Napiši deamon's PID za ovu datoteku"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Koristi SSL klijent sertifikat CERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Upozori kada sertifikat vrijemeživota < DANI"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Koristi SSL privatni ključ datoteke KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Koristi WebVPN cookie COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Pročitaj cookie sa standardnog ulaza"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Omogući sažimanje (Uobičajno)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Onemogući sažimanje"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Postavi minimum Dead Peer Detection interval"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Postavi login korisničkugrupu"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Pomoćni tekst na zaslonu"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Koristi IFNAME for tunel sučelje"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Koristi syslog za punjenje poruka"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Prepend timestamp u toku poruke"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Odbaci privilegije poslije povezivanja"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Odbaci privilegije tokom CSD izvršavanja"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Pokreni SCRIPT umjesto CSD binarne"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Postaviti put MTU za/od servera"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Postaviti ključ lozinku ili TPM SRK PIN"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Lozinka je fsid od datoteke sistema"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Postavi proxy server"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Postavite proxy metode provjere autentičnosti"
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Onemogući proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Koristi libproxy za automatsko konfigurisanje proxy"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(BILJEŠKA: libproxy onemogućen u ovoj izradi)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Zahtijeva se savršeno prosljeđivanje tajnosti"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Nema izlaza"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Postavi paket red ogranicen na LEN pkts"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "Okolna komandna linija za korištenje vpnc-kompatibilna onfig skripta"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "podrazumijevano"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Prođi put do 'script' program"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Postavi login korisnicko ime"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Prijavi broj verzije"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Još izlaza"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Smetljište HTTP ovjera puta (implicira --verbose"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML config datoteka"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Odaberi ovjeru  za login odabir"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Ovjeri samo i printaj informacije o unosu"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Samo donesi webvpn cookie; ne povezuj se"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Otkucaj webvpn cookie prije povezivanja"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Cert datoteka za provjeru servera"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Ne pitaj za IPv6 povezivanje"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "OpenSSL šifra za podršku za DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Onemogući DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Onemogući ponovnu upotrebu HTTP konekcije"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Isključi šifru/SecurID ovjeru"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Ne zahtijeva server SSL cert da bi bio validan"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Isključuje osnovne sistemske izdavače uvjerenja"
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Ne pokušaL POST ovjeru"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Ne očekuj unos korisnika; izađi ako je to zatraženo"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Učitaj šifru sa standardnog ulaza"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Softver znak tipa: rsa, totp or hotp"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Software token skriven"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(BILJEŠKA: libstoken (RSA SecurID) isključen u ovoj izgradnji)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(NAPOMENA: „Yubikey“ OATH je isključen u ovoj izgradnji)"
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Vrijeme u sekundama nakon koga konekcija ističe"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Server certifikat SHA1 otisakprsta"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP zaglavlje Korisnik-Agent: polje"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "OS tip (linux,linux-64,win,...) za izvještaj"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Postavi lokalni port za FTLS datagrams"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Greška pri alociranju stringa\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Ne može uzeti red iz config datoteke: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Ne prepoznatljiva opcija u redu %d: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Opcija '%s' ne prima argument iz reda %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Opcija '%s' zahtijeva argument u redu %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2354,7 +2393,7 @@ msgstr ""
 "         podržava, ali izgleda kao da koristite stari znak\n"
 "         postavi \"%s\". Očekujte bizarnosti.\n"
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2363,42 +2402,42 @@ msgstr ""
 "UPOZORENJE: Ova verzija otvorene veze je %s, ali\n"
 "         libopenconnect biblioteka je %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Neuspijeh pri alociranju vpninfo strukture\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Ne može koristiti 'config' opciju unutar config datoteke\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Ne može otvoriti config datoteku '%s': %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Pogrešan kompresioni režim '%s'\n"
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d previše mali\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2407,125 +2446,132 @@ msgstr ""
 "Isključivanje svih HTTP konekcija ponovna upotreba uslijed --no-http-"
 "keepalive opcije.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Nulta dužina reda nije dopuštena; koristi 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect verzja %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Pogrešan software toke režim \"%s\"\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Pogrešan OS identitet \"%s\"\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Previše argumenata na komandnoj liniji\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Nijedan server nije specificiran\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Ova verzija openconnect je napravljena bez podrške za libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Greška prilikom otvaranja cmd pipe-a\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Nemoguće dobiti WebVPN cookie\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Kreiranje SSL konekcije neuspjelo\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Instaliranje DTLS neuspjelo; umjesto toga koristi SSL\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Nije obezjbeđen --script argument; DNS i usmjeravanje nije konfigurisano\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Pogledaj http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Ne može otvoriti '%s' za pisanje: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Nastavljanje u pozadini; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Korisnički zahtjev ponovo uspostavlja konekciju\n"
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Cookie je izbacio ponovnu konekciju; izlazak.\n"
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Sesija prestaje serverom; izlazak.\n"
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Korisnik je otkazao (SIGINT); izlazak.\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Korisnik je odvojen od sjednice (SIGHUP); izlazak.\n"
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Nepoznata greška; izlazak.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Ne može otvoriti %s za pisanje: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Ne može pisati config u %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Server SSL certifikat nije uspostavljen: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2536,90 +2582,101 @@ msgstr ""
 "Certifikat od VPN servera \"%s\" neuspjela ovjera.\n"
 "Razlog: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Unesi '%s' za prihvatanje, '%s' za ignorisanje; bilo što drugo da vidiš: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ne"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "da"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Heš serverskog ključa: %s\n"
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Auth izbor \"%s\" poklapa se s više opcija\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Auth izbor \"%s\" nije dostupan\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Korisnički unos zahtijeva ne-interaktivni režim\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Neuspješno otvaranje datoteke znaka za pisanje: %s\n"
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Neuspješno pisanje znaka: %s\n"
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Soft token string nije ispravan\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Ne može otvoriti ~/.stokenrc file\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect nije izgrađen sa libstoken podrškom\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Opći neuspjeh u libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect nije izgrašen sa liboath podrškom\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Opći neuspjeh u liboath\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Nisam našao modul Jubi ključa\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "Otvoreno povezivanje nije izgrađeno sa podrškom Jubi ključa\n"
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Opšti neuspjeh Jubi ključa: %s\n"
@@ -2634,16 +2691,16 @@ msgstr "Nije postavljen tun script\n"
 msgid "Set up tun device failed\n"
 msgstr "Instaliranje tun uređaja neuspjelo\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Pozivatelj je pauzirao konekciju\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Nema šta za uraditi; gašenje za %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "Čekanje na više objekata nije uspelo: %s\n"
@@ -2709,7 +2766,7 @@ msgstr "Server je odbio soft token; promijenite na ručni ulaz\n"
 msgid "Generating OATH TOTP token code\n"
 msgstr "Generisanje OATH TOTP token koda\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Generisanje OATH HOTP oznake koda\n"
 
@@ -2841,505 +2898,622 @@ msgstr "Dobijena KMP poruka %d veličine %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Primljen ne-ESP TLV (grupa %d) u ESP dogovoru KMP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Greška kreirajući oNCP zahtjev za pregovor\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Kratko pisanje u oNCP ugovaranju\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Pročitano %d bajta SSL zapisa\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Neočekivan odgovor veličine %d nakon hostname paketa\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Serverski odgovor na hostname paket je greška 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Pogrešan paket čeka na KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Očekivana KMP poruka 301 sa servera ali je dobijeno %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Greška usaglašavanja ESP ključeva:\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "novi dolazni"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "novi odlazni"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr "Ignoršem ESP ključeve pošto ESP podrška nije dostupna u ovoj gradnji\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Nepoznata KMP poruka %d veličine %d\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d dodatnih bajtova neprimljeno\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Odlazni paket:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Poslan ESP omogućujući kontrolni paket\n"
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "GREŠKA: %s() pozvana sa neispravnim UTF-8 za '%s' argumentom\n"
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Neuspjelo  kreirati SSL_SESSION ASN.1 za OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "OpenSSL neuspio analizirati SSL_SESSION ASN.1\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Postavljanje DTLSv1 sesije neuspjelo\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Postavljanje DTLSv1 CTX neuspjelo\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Postavljanje DTLS šifre neuspjelo\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Nije precizirana jedna DTLS šifra\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"Seje http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Usi the --no-dtls command linije option to avoid this message\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "Osnovana DTLS veza (pomoću OpenSSL). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Tvoj OpenSSL je stariji od ovog kojeg si napravio ponovo, pa DTLS možda neće "
+"uspjeti!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Ovo je možda zato što tvoj OpenSSL je pukao\n"
+"Pogledaj http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS spajanje neuspjelo: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Neuspjelo inicijalizirati ESP šifru:\n"
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr "Neuspjelo inicijalizirati ESP HMAC\n"
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr "Neuspjelo generisati slučajne ključeve za ESP:\n"
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr "Neuspjelo postavljanje dekripcijskog konteksta za ESP paket:\n"
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr "Neuspjelo dešifrovanje ESP paketa:\n"
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr "Neuspjelo generisati slučajni IV za ESP paket:\n"
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr "Neuspjelo postavljanje enkripcijskog konteksta za ESP paket:\n"
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr "Neuspjelo šifrovanje ESP paketa:\n"
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr "Nisam uspeo da uspostavim libp11 PKCS#11 kontekst:\n"
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr "Nisam uspeo da učitam modul PKCS#11 dostavljača (%s):\n"
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN je zaključan\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN je istekao\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Drugi korisnik je već prijavljen\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr "Nepoznata greška prijavljivanja na PKCS#11 modul\n"
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr "Prijavljen sam na PKCS#11 priključak „%s“\n"
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr "Nisam uspeo da nabrojim uvjerenja u PKCS#11 priključku „%s“\n"
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr "Nađoh %d uvjerenja u priključku „%s“\n"
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr "Nisam uspeo da obradim PKCS#11 putanju „%s“\n"
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr "Nisam uspeo da nabrojim PKCS#11 priključke\n"
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr "Prijavljujem se na PKCS#11 priključak „%s“\n"
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "libp11 nije dovukla sadržaj H.509 uverenja\n"
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Neuspješno instaliranje potvrde u OpenSSL kontekstu\n"
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr "Nisam uspeo da nabrojim ključeve u PKCS#11 priključku „%s“\n"
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr "Nađoh %d ključa u priključku „%s“\n"
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr "Nisam uspeo da napravim primjerak ličnog ključa iz PKCS#11\n"
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr "Dodavanje ključa iz PKCS#11 nije uspelo\n"
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Ovo izdanje Otvorenog povezivanja je izgrađeno bez PKCS#11 podrške\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Neuspjeh pri upisivanju u SSL soket\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Ne može pročitati iz SSL soketa\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "SSL očitao grešku %d (moguće je da će server zatvoriti konekciju); ponovno "
 "konektovanje.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_upis neuspio: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Nepoznata vrsta zahtjeva KS SSL-a %d\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM šifra preduga (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Posebni cert iz %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Fraza PKCS#12 neuspjela (napravi uvid u greške)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 ne sadrži certifikat!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 ne sadrži privatni ključ!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Ne može učitati TPM engine.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Ne može pokrenuti TPM engine\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Ne može postaviti TPM SRK šifru\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Ne može učitati TPM privatni ključ\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Dodavanje ključa iz TPM neuspjelo\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Neuspjeh pri otvaranju certifikat datoteke %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Učitavanje certifikata neuspjelo\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Neuspješno procesiranje svih cert-ova podrške. Pokušavaj u svakom "
 "slučaju...\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "PEM datoteka"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Ne može kreirati BIO za keystore objekt '%s'\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Učitavanje privatnog ključa neuspjelo (pogrešna šifra?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Učitavanje privatnog ključa neuspjelo (izvrši uvid grešaka)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Neuspjelo učitavanje X509 certifikata iz keystore\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Nemoguće korištenje X509 certifikata iz keystore\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Nemoguće koristiti privatni ključ iz keystore\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Ne može otvoriti privatnu ključ datoteku %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Neuspješno preuzimanje privatnog ključa\n"
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Ne može identifikovati tip privatnog ključa u '%s'\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Matched DNS altname '%s'\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Ne odgovara za altname '%s'\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Certifikat ima GEN_IPADD altname sa prividnom dužinom %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Uparena %s adresa '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Ne odgovara za %s adresu '%s'\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' ima ne praznu putanju; ukidanje\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Odgovarajući URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Ne odgovara za URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Nema altname u odgovarajućem certifikatu '%s'\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Nema imena subjekta u certifikatu!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Ne može razdvojiti ime subjekta u certifikatu\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Subjekat certifikata je neusklađen  ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Odgovarajuće ime subjekta certifikata '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Dodatni cert iz cafile: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Greška u klijent cert notAfter polje\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<greška>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Nemoguće pročitati certs iz CA datoteke '%s'\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Ne može otvoriti CA datoteku '%s'\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Spajanje SSL neuspjelo\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Neuspjelo izračunavanje OATH HMAC\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Odbaci lošu podjelu uključujući: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Odbaci lošu podjelu isključujući: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Nemoguće spawn script '%s' za %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Script '%s' zavrišio nenormalno (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Script '%s' vraćena greška %d\n"
@@ -3638,84 +3812,96 @@ msgstr "Neispravan PIN format; pokušajte ponovo.\n"
 msgid "Generating RSA token code\n"
 msgstr "Generisanje RSA token koda\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Greška prilikom pristupa ključu registra za mrežne adaptere\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Ignorisanje neodgovarajućeg TAP interfejsa \"%s\"\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Nije pronađen Windows-TAP adapter. Je li instaliran drajver?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Neuspjelo otvaranje %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Otvoren tun uređaj %s\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Nisam uspeo da dobijem izdanje TAP upravljačkog programa: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Greška: TAP-Windows driver v9.9 ili veći je potreban (pronađen %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Nisam uspeo da podesim TAP IP adrese: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Nisam uspeo da podesim stanje TAP medija: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "TAP uređaj je prekinuo povezivost. Prekidam vezu.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Nisam uspeo da čitam sa TAP uređaja: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Nisam uspeo da dovršim čitanje sa TAP uređaja: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Napisano %ld bajta za tun\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Čekanje za tun pisanje...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Napisano %ld bajta za tun nakon čekanja\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Nisam uspeo da pišem na TAP uređaj: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Miješanje tunel oznaka nije još uvijek podržano na Windowsu\n"
 
diff --git a/po/ca.po b/po/ca.po
index 9b28af6a..58e71e3f 100644
--- a/po/ca.po
+++ b/po/ca.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-09-08 12:49+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Catalan (http://www.transifex.net/projects/p/meego/team/ca/)\n"
@@ -175,7 +175,7 @@ msgstr "S'ha preguntat per la contrasenya però està configurat «--no-passwd»
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "No s'està descarregant el perfil XML ja que SHA1 concorda realment\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Error en obrir la connexió HTTPS amb %s\n"
@@ -318,531 +318,461 @@ msgstr "(Error mentre es descrivia l'error!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "ERROR: No es poden inicialitzar els sòcols\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "ERROR CRÍTIC: el secret mestre DTLS no està inicialitzat. Informeu-ne.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Error mentre es crea la sol·licitud CONNEXIÓ HTTPS\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Error en recollir la resposta HTTPS\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Servei VPN no disponible; motiu: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "S'ha obtingut la resposta inapropiada CONNEXIÓ HTTP: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "S'ha obtingut la resposta CONNEXIÓ: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "No hi ha memòria per a les opcions\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID no són 64 caràcters; són: «%s»\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Desconegut DTLS-Content-Encoding %s\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Desconegut CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Cap MTU rebut. S'està avortant\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Cap adreça IP rebuda. S'està avortant\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "S'ha rebut la configuració IPv6 però MTU %d és massa petit.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Torneu a connectar i doneu una adreça IP antiga diferent (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "Torneu a connectar i doneu una mascara de xarxa IP antiga diferent (%s != "
 "%s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Torneu a connectar i doneu una adreça IPv6 diferent (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 "Torneu a connectar i doneu una mascara de xarxa IPv6 diferent (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP connectat. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "Conjunt de xifrat CSTP: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "La configuració de la compressió ha fallat\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "L'assignació de la memòria intermèdia de desinflat ha fallat\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "La inflació ha fallat\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "La descompressió LZS ha fallat: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "La descompressió LZ4 ha fallat\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Tipus de compressió desconegut %d\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "S'han rebuts %s paquets de dades comprimides de %d bytes (eren %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "La deflació ha fallat %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "L'assignació ha fallat\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "S'ha rebut un paquet petit (%d bytes)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Paquet gran inesperat. SSL_read mostra %d però el paquet és\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "S'ha rebut la petició DPD CSTP\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "S'ha rebut la resposta DPD CSTP\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "S'ha rebut Keepalive CSTP\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "S'ha rebut paquet de dades descomprimides de %d bytes\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "S'ha rebut el servidor desconnectat: %02x «%s»\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "S'ha rebut el servidor desconnectat\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "S'ha rebut paquet comprimit! Mode desinflat\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "S'ha rebut servidor de paquet d'acabat\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Paquet desconegut %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL ha escrit molt pocs bytes! S'ha preguntat per %d, s'ha enviat %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Degut a la reclau CSTP\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Reencaixada errònia; s'està intentant un túnel nou\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "El detector de parells morts CSTP ha detectat un parell mort!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Reconnexió errònia\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Envia DPD CSTP\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Envia Keepalive CSTP\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "S'està enviant un paquet de dades comprimides de %d bytes (eren %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "S'està enviant un paquet de dades descomprimides de %d bytes\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Envia paquet ADÉU: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "S'està intentant autenticar el resum per al servidor intermediari\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "S'està intentant autenticar el resum per al servidor «%s»\n"
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr "Error en crear ASN.1 SSL_SESSION per a OpenSSL: %s\n"
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr "OpenSSL ha fallat en analitzar ASN.1 SSL_SESSION\n"
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "La inicialització de la sessió DTLSv1 ha fallat\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "La inicialització de CTX DTLSv1 ha fallat\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr "L'establiment de la versió DTLS CTX ha fallat\n"
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "La configuració de la llista de xifrat DTLS ha fallat\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "No hi ha sols un xifrat DTLS\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() ha fallat amb un protocol antic amb versió 0x%x\n"
-"Esteu utilitzant una versió de OpenSSL més vella que 0.9.8m?\n"
-"Mireu http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Useu l'opció --no-dtls a la línia d'ordres per evitar aquest missatge\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-"Establerta la connexió DTLS (utilitzant OpenSSL). Entorn de xifrat %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr "Compressió de connexió DTLS usant %s.\n"
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"La vostra OpenSSL és més antiga que una que heu muntat abans, per això DTLS "
-"pot fallar!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "L'encaixada DTLS ha expirat\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Això és degut a que el vostre OpenSSL està trencat\n"
-"Mireu http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "L'encaixada DTLS ha fallat: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Paràmetres DTLS desconeguts en l'entorn de xifrat demanat «%s»\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Error en establir la prioritat DTLS: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Error en establir els paràmetres de la sessió DTLS: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Error en establir MTU DTLS: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Establerta la connexió DTLS (usant GnuTLS). Entorn de xifrat %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Error d'encaixat DTLS: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(Està un tallafocs impedint que envieu paquets UDP?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "Connexió DTLS intentada amb un FD\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Sense adreça DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "El servidor no ha oferit cap opció de xifrat DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Sense DTLS quan es connecta amb un servidor intermediari\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Opció DTLS %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS inicialitzades. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Intenta una connexió nova DTLS\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Rebuts 0x%02x paquets DTLS de %d bytes\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "S'ha obtingut la petició DPD DTLS\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Error en enviar la resposta DPD. S'esperava desconnexió\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "S'ha obtingut la resposta DPD DTLS\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "S'ha obtingut Keepalive DTLS\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 "S'ha rebut paquet DTLS comprimit quan la compressió no està habilitada\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Paquet desconegut DTLS de tipus %02x, longitud %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Degut a la reclau DTLS\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Reencaixat DTLS fallat; s'està reconnectant.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "El detector de parells morts DTLS ha detectat un parell mort!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Envia DPD DTLS\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Error en enviar la sol·licitud DPD. S'esperava la desconnexió\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Envia Keepalive DTLS\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Error en enviar la sol·licitud keepalive. S'esperava desconnexió\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 "S'ha rebut un paquet desconegut  (longitud %d): %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr "TOS aquest: %d, TOS últim: %d\n"
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr "UDP setsockopt"
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 "DTLS ha tingut l'error d'escriptura %d. Alternativament s'utilitzarà SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 "DTLS ha tingut l'error d'escriptura: %s. Alternativament s'utilitzarà SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "S'ha enviat el paquet DTLS de %d bytes; DTLS envia %d retornats\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
-msgstr "Connexió SSL cancel·lada\n"
-
-#: dtls.c:1169
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "S'està iniciant la detecció IPv4 MTU (mín=%d, màx=%d)\n"
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
-msgstr "Temps massa llarg al bucle de detecció del MTU; es deixa estar.\n"
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
+#, c-format
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
+msgstr ""
+
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
+msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
-msgstr "No s'ha pogut enviar la demanda DPD (%d): %s \n"
+msgid "Failed to send DPD request (%d %d)\n"
+msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 "S'ha rebut un paquet inesperat (%.2x) a la detecció del MTU; s'ignorarà.\n"
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
-msgstr "No s'ha pogut rebre la demanda DPD (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "S'està iniciant la detecció IPv6 MTU\n"
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "S'ha detectat MTP de %d bytes (era %d)\n"
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Cap canvi al MTU després de la detecció (era %d)\n"
@@ -978,6 +908,97 @@ msgstr "Error en enviar el paquet ESP: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "S'ha enviat el paquet ESP de %d bytes\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Paràmetres DTLS desconeguts en l'entorn de xifrat demanat «%s»\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Error en establir la prioritat DTLS: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Error en establir els paràmetres de la sessió DTLS: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Error en establir MTU DTLS: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Establerta la connexió DTLS (usant GnuTLS). Entorn de xifrat %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr "Compressió de connexió DTLS usant %s.\n"
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "L'encaixada DTLS ha expirat\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Error d'encaixat DTLS: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(Està un tallafocs impedint que envieu paquets UDP?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -1017,7 +1038,7 @@ msgstr "Error en generar el paquet IV ESP: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Error en xifrar el paquet ESP: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Escriptura SSL cancel·lada\n"
 
@@ -1026,492 +1047,496 @@ msgstr "Escriptura SSL cancel·lada\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Error en escriure al sòcol SSL: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Lectura SSL cancel·lada\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "Sòcol SSL tancat de forma no neta\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Error en llegir del sòcol SSL: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Error de lectura SSL:%s; s'està tornant a connectar.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "Ha fallat l'enviament SSL: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "No es pot extraure el temps caducitat del certificat\n"
 
-#: gnutls.c:306 openssl.c:1578
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "El certificat ha caducat a"
 
-#: gnutls.c:308 openssl.c:1583
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "El certificat del client caducarà aviat a"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Error en carregar l'element «%s» del magatzem de claus: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Error en obrir el fitxer %s de clau/certificat: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Error en fer «stat» al fitxer %s de clau/certificat: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Error en assignar la memòria intermèdia del certificat\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Error en llegir el certificat dins la memòria: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Error en configurar l'estructura de dades PKCS#12: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Error en desxifrar el certificat del fitxer PKCS#12\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Entreu la contrasenya PKCS#12:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Error en processar el fitxer PKCS#12:  %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Error en carregar el certificat PKCS#12: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "La importació del certificat X509 ha fallat: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "La configuració del certificat PKCS#11 ha fallat: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "No es pot inicialitzar el resum MD5:  %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "Error al resum MD5: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "S'ha perdut DEK-Info: capçalera de la clau xifrada d'OpenSSL\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "No es pot determinar el tipus de xifrat PEM\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Tipus de xifrat PEM no suportat: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Sal no vàlida al fitxer PEM xifrat\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Error de base64 en descodificar el fitxer PEM xifrat: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Fitxer PEM xifrat massa curt\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Error en inicialitzar el xifrat per desxifrar el fitxer PEM: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Error en desxifrar la clau PEM: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "El desxifrat de la clau PEM ha fallat\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Entreu la contrasenya PEM:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Aquest binari està muntat sense suport de claus de sistema\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Aquest binari està muntat sense suport de PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:407
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "S'està utilitzant el certificat %s PKCS#11\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "S'està usant el certificat de sistema %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Error en carregar el certificat de PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Error en carregar el certificat de sistema: %s\n"
 
-#: gnutls.c:1114 openssl.c:810
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "S'està usant el certificat del fitxer %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "El fitxer PKCS#11 no conté cap certificat\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "No s'ha trobat cap certificat al fitxer"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "La carrega del certificat ha fallat: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "S'està usant la clau de sistema %s\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Error en inicialitzar l'estructura de la clau privada: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Error en importar la clau de sistema %s: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "S'està intentant PKCS#11 de clau URL %s\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Error inicialitzant PKCS#11 d'estructura de clau: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Error en importar  PKCS#11 URL %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:644
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "S'està usant PKCS#11 clau %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 "Error en importar clau  PKCS#11 dins de l'estructura de clau privada: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "S'està usant el fitxer de clau privada %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Aquesta versió d'OpenConnect ha sigut muntada sense suport de TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Error en interpretar el fitxer PEM\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Error en carregar la clau privada PKCS#1: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Error en carregar la clau privada com PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:981 openssl.c:991
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Error en desxifrar el fitxer del certificat PKCS#8\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Error en determinar el tipus de clau privada %s\n"
 
-#: gnutls.c:1518 openssl.c:987
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Introduïu la contrasenya PKCS#8:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Error en obtenir la identificació de la clau: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Error de dades de la prova de signatura amb la clau privada: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Error en validar la signatura del certificat: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "No s'ha trobat cap certificat SSL que concordi amb la clau privada\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "S'està usant el certificat del client «%s»\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 "La configuració de la llista de recuperació del certificat ha fallat: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Error en assignar memòria per al certificat\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "AVÍS: GnuTLS ha retornat un certificat emissor incorrecte; l'autenticació "
 "pot haver fallat!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "S'ha obtingut el següent CA «%s» de PKCS11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Error en assignar memòria per als certificats suportats\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "S'està afegint el suport CA «%s»\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "La configuració del certificat ha fallat:  %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "El servidor no ha presentat cap certificat\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 "S'ha produït un error quan s'estava comparant el certificat del servidor a "
 "la reencaixada: %s\n"
 
-#: gnutls.c:2042 openssl.c:1501
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "El servidor ha presentat un certificat diferent a la reencaixada\n"
 
-#: gnutls.c:2047 openssl.c:1504
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "El servidor ha presentat un certificat idèntic a la reencaixada\n"
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Error en inicialitzar l'estructura de certificat X509\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Error en importar el certificat del servidor\n"
 
-#: gnutls.c:2068 main.c:1695
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "No es pot calcular el resum del certificat del servidor\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Error en comprovar l'estat del certificat del servidor\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certificat revocat"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "signant no trobat"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "signant sense certificat CA"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "algoritme insegur"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certificat no activat encara"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certificat expirat"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "la verificació de la signatura ha fallat"
 
-#: gnutls.c:2142 openssl.c:1385 openssl.c:1537
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "el certificat no concorda amb el nom de l'amfitrió"
 
-#: gnutls.c:2147 openssl.c:1384 openssl.c:1543
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "La verificació del certificat el servidor ha fallat: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Error en assignar memòria per al certificat de fitxer CA\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Error en llegir certificats del fitxer CA: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Error en obrir el fitxer CA «%s»: %s\n"
 
-#: gnutls.c:2269 openssl.c:1660
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "La carrega del certificat ha fallat. S'està avortant.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 "No s'ha pogut establir la cadena de caràcters de prioritat TLS («%s»): %s\n"
 
-#: gnutls.c:2352 openssl.c:1777
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Negociació SSL amb %s\n"
 
-#: gnutls.c:2399 openssl.c:1803
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Connexió SSL cancel·lada\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Connexió SSL fallada: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS retorna no fatal durant la reencaixada:  %s\n"
 
-#: gnutls.c:2421 openssl.c:1820
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "S'ha connectat a HTTPS en %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "S'ha renegociat SSL en %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:199
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "Cal PIN en %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:202
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "PIN dolent"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Aquest és l'últim intent abans de bloquejar-ho!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Només alguns intents abans de bloquejar-ho!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:206
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Entreu el PIN:"
 
-#: gnutls.c:2752 openssl.c:1948
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Algoritme HMAC OATH no suportat\n"
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Error en calcular HMAC OATH: %s\n"
@@ -1723,7 +1748,7 @@ msgstr "S'està intentant l'autenticació bàsica HTTP al servidor intermediari\
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "S'està intentant l'autenticació bàsica HTTP al servidor «%s»\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Aquesta versió d'OpenConnect ha sigut muntada sense suport GSSAPI\n"
 
@@ -1745,251 +1770,251 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "No hi ha més mètodes d'autenticació per a provar\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "No hi ha memòria per assignar galetes\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Error per a analitzar la resposta HTTP «%s»\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "S'ha obtingut la resposta HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Error en processar la resposta HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "S'està ignorant la resposta HTTP desconeguda de línia «%s»\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Galeta oferida no vàlida: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "L'autenticació del certificat SSL ha fallat\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "La resposta del cos té una mida negativa (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Codificació de transferència desconeguda: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "Cos HTTP %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Error en llegir el cos de la resposta HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Error en recollir un fragment de capçalera\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Error en recollir el cos de la resposta HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Error en un fragment descodificat. S'esperava '', s'ha obtingut «%s»"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "No es pot rebre el cos HTTP 1.0 sense tancar la connexió\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Error per a analitzar la redirecció URL «%s»: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "No es pot seguir la redirecció a la URL no https «%s»\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "S'està assignant el nou camí per la redirecció relativa errònia: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Resultat %d inesperat del servidor\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "petició concedida"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "errada general"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "connexió no permesa per configurador de regles"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "xarxa no disponible"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "servidor no disponible"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "connexió rebutjada pel servidor de destí"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL caducada"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "ordre no suportada / error de protocol"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "tipus d'adreça no suportada"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "Servidor SOCKS ha preguntat per nom d'usuari / contrasenya però no n'hi ha\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "El nom d'usuari i la contrasenya per a l'autenticació SOCKS cal que sigui < "
 "255 bytes\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 "Error en escriure la sol·licitud d'autenticació per al servidor intermediari "
 "SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 "Error en llegir la resposta de l'autenticació per al servidor intermediari "
 "SOCKS: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 "Resposta d'autenticació desconeguda del servidor intermediari SOCKS: %02x "
 "%02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Autenticat al servidor SOCKS utilitzant la contrasenya\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Contrasenya d'autenticació al servidor SOCKS errònia\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "El servidor SOCKS ha preguntat per autenticació GSSAPI\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "El servidor SOCKS ha preguntat per autenticació de contrasenya\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "El servidor SOCKS demana autenticació\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 "El servidor SOCKS ha demanat per autenticació del tipus desconegut %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 "S'està sol·licitant connexió al servidor intermediari SOCKS per %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 "Error en escriure la sol·licitud de connexió al servidor intermediari SOCKS: "
 "%s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 "Error en llegir la resposta de connexió al servidor intermediari SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 "Resposta de connexió inesperada al servidor intermediari SOCKS:%02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Error al servidor intermediari SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Error al servidor intermediari SOCKS %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Tipus d'adreça inesperada %02x a la resposta de connexió SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 "S'està sol·licitant la connexió al servidor intermediari HTTP per %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "L'enviament de la sol·licitud al servidor intermediari ha fallat: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "La sol·licitud de CONNEXIÓ al servidor intermediari ha fallat:  %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Tipus de servidor intermediari desconegut «%s»\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Sols estan suportats http o el servidor intermediaris socks(5)\n"
 
@@ -2002,16 +2027,28 @@ msgstr "Protocol VPN desconegut «%s»\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Muntatge de la llibreria SSL sense suport DTLS Cisco\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Error en analitzar el servidor URL  «%s»\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Sols està permès https:// per la URL servidor\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Sense formulari gestor; no es pot autenticar.\n"
 
@@ -2027,20 +2064,25 @@ msgstr "Error fatal en la gestió de la línia d'ordres\n"
 
 #: main.c:382
 #, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
+#, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() ha fallat: %s\n"
 
-#: main.c:396 main.c:409
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Error en convertir l'entrada de consola: %s\n"
 
-#: main.c:403 main.c:639
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Assignació errònia de la cadena de l'entrada estàndard\n"
 
-#: main.c:570
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -2049,25 +2091,21 @@ msgstr ""
 "Per assistència amb OpenConnect, mireu la pàgina web a\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:579
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "S'està utilitzant OpenSSL. Característiques presents:"
 
-#: main.c:581
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "S'està utilitzant GnuTLS. Característiques presents:"
 
-#: main.c:590
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "L'OpenSSL ENGINE no està present"
 
-#: main.c:622
-msgid "using OpenSSL"
-msgstr "s'està usant OpenSSL"
-
-#: main.c:626
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2076,31 +2114,31 @@ msgstr ""
 "\n"
 "AVÍS: Sense suport DTLS en aquest binari. Es veurà perjudicat el rendiment.\n"
 
-#: main.c:663
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:703
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "No es pot processar aquest camí executable «%s»"
 
-#: main.c:709
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "L'assignació del camí per a vpnc-script ha fallat\n"
 
-#: main.c:729
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Sobreescriu el nom de l'ordinador de «%s» a «%s»\n"
 
-#: main.c:742
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Ús:  openconnect [opcions] <server>\n"
 
-#: main.c:743
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2109,309 +2147,309 @@ msgstr ""
 "Client obert per a Cisco AnyConnect VPN, versió %s\n"
 "\n"
 
-#: main.c:745
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Llegeix les opcions del fitxer de configuració"
 
-#: main.c:747
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Continua al fons després de l'inici"
 
-#: main.c:748
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Escriu els PID dels dimonis per aquest fitxer"
 
-#: main.c:750
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Usa el certificat CERT del client SSL"
 
-#: main.c:751
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Avisa quan la vida del certificat < DAYS"
 
-#: main.c:752
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Usa la clau privada SSL al fitxer KEY"
 
-#: main.c:753
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Usa WebVPN galeta COOKIE"
 
-#: main.c:754
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Llegeix la galeta de l'entrada estàndard"
 
-#: main.c:755
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Habilita la compressió (per defecte)"
 
-#: main.c:756
+#: main.c:766
 msgid "Disable compression"
 msgstr "Deshabilita la compressió"
 
-#: main.c:757
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Configura l'interval mínim de detecció de parells morts"
 
-#: main.c:758
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Configura l'entrada del grup d'usuaris"
 
-#: main.c:759
+#: main.c:769
 msgid "Display help text"
 msgstr "Mostra text d'ajuda"
 
-#: main.c:760
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Usa IFNAME per la interfície de túnel"
 
-#: main.c:762
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Usa registres de sistema per al progrés dels missatges"
 
-#: main.c:764
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Avantposa la marca horària per al progrés dels missatges"
 
-#: main.c:765
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr "copia TOS / TCLASS quan s'usa DTLS"
 
-#: main.c:767
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Descarta els privilegis després de la connexió"
 
-#: main.c:768
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Descarta els privilegis durant l'execució CSD"
 
-#: main.c:769
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Executa SCRIPT en lloc de binari CSD"
 
-#: main.c:771
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr "Demana del MTU al servidor (sols servidors antics)"
 
-#: main.c:772
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indica el camí MTU a / des del servidor"
 
-#: main.c:773
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Configura la contrasenya de la clau o PIN SRK TPM"
 
-#: main.c:774
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "La contrasenya de la clau és fsid del sistema de fitxers"
 
-#: main.c:775
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Configura el servidor intermediari"
 
-#: main.c:776
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Configura els mètodes d'autenticació del servidor intermediari"
 
-#: main.c:777
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Deshabilita el servidor intermediari"
 
-#: main.c:778
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 "Utilitza libproxy per configurar de forma automàtica el servidor intermediari"
 
-#: main.c:780
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTA: libproxy deshabilitat en aquest muntatge)"
 
-#: main.c:782
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Requerida confidencialitat directa perfecta"
 
-#: main.c:783
+#: main.c:793
 msgid "Less output"
 msgstr "Menys sortida"
 
-#: main.c:784
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Configura el límit de la cua del paquet a LEN pkts"
 
-#: main.c:785
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Terminal de la línia d'ordres per utilitzar un vpnc compatible amb el script "
 "de configuració"
 
-#: main.c:786
+#: main.c:796
 msgid "default"
 msgstr "per defecte"
 
-#: main.c:788
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Passa el trafic al «script» del programa, no al controlador de xarxa"
 
-#: main.c:790
+#: main.c:800
 msgid "Set login username"
 msgstr "Configura el nom d'usuari d'entrada"
 
-#: main.c:791
+#: main.c:801
 msgid "Report version number"
 msgstr "Informa del nombre de versió"
 
-#: main.c:792
+#: main.c:802
 msgid "More output"
 msgstr "Més sortida"
 
-#: main.c:793
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Bolca el trafic d'autenticació HTTP (implica --verbose"
 
-#: main.c:794
+#: main.c:804
 msgid "XML config file"
 msgstr "Fitxer de configuració XML"
 
-#: main.c:795
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Trieu la selecció d'autenticació de l'entrada de sessió"
 
-#: main.c:796
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Autentica sols i imprimeix la informació de l'entrada de sessió"
 
-#: main.c:797
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Recupereu sols la galeta webvpn; no connecteu"
 
-#: main.c:798
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Imprimiu la galeta webvpn abans de connectar-vos"
 
-#: main.c:799
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Fitxer CERT per la verificació del servidor"
 
-#: main.c:800
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "No pregunteu per la connectivitat IPv6"
 
-#: main.c:801
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Xifrat OpenSSL per suportar a DTLS"
 
-#: main.c:802
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Deshabilita DTLS"
 
-#: main.c:803
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Deshabilita la reutilització de la connexió HTTP"
 
-#: main.c:804
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Deshabilita l'autenticació de la contrasenya/SecurID"
 
-#: main.c:805
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "No es requereix el certificat SSL del servidor per validar-se"
 
-#: main.c:806
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Deshabilita per defecte els certificats d'autoritats del sistema"
 
-#: main.c:807
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "No intentis l'autenticació POST XML"
 
-#: main.c:808
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "No esperis entrada de l'usuari; surt si aquesta és requerida"
 
-#: main.c:809
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Llegeix la contrasenya de l'entrada estàndard"
 
-#: main.c:810
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Tipus de testimoni de programari: rsa, totp o hotp"
 
-#: main.c:811
+#: main.c:821
 msgid "Software token secret"
 msgstr "Testimoni secret de programari"
 
-#: main.c:813
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(NOTA: libstoken (RSA SecurID) deshabilitada en aquest muntatge)"
 
-#: main.c:816
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(NOTA: Yubikey OATH deshabilitada en aquest muntatge)"
 
-#: main.c:818
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Temps d'espera en segons per reintentar la connexió"
 
-#: main.c:819
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Empremta SHA1 del certificat del servidor"
 
-#: main.c:820
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Capçalera HTTP de l'usuari-agent: camp"
 
-#: main.c:821
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Nom d'amfitrió local per publicitar al servidor"
 
-#: main.c:822
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Usa l'IP quan et connectis a HOST"
 
-#: main.c:823
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Tipus de sistema operatiu (linux,linux-64,win,...) per l'informe"
 
-#: main.c:824
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Configura el port per als datagrames DTLS"
 
-#: main.c:845
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Error en assignar la cadena\n"
 
-#: main.c:906
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Error en obtindre la línia del fitxer de configuració: %s\n"
 
-#: main.c:946
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Opció no reconeguda a la línia %d: «%s»\n"
 
-#: main.c:956
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "L'opció «%s» no té argument a la línia %d\n"
 
-#: main.c:960
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "L'opció «%s» requereix un argument a la línia %d\n"
 
-#: main.c:985
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Usuari no vàlid «%s»: %s\n"
 
-#: main.c:995
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "ID d'usuari no vàlid «%d»: %s\n"
 
-#: main.c:1047
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2422,7 +2460,7 @@ msgstr ""
 "          per iconv però sembla que esteu utilitzant un caràcter antic\n"
 "         establert com «%s». S'esperen coses estranyes.\n"
 
-#: main.c:1054
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2431,42 +2469,42 @@ msgstr ""
 "AVÍS: Aquesta versió d'openconnect és %s però\n"
 "         la llibreria libopenconnect és %s\n"
 
-#: main.c:1064
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Error en assignar l'estructura vpninfo\n"
 
-#: main.c:1119
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "No es pot utilitzar l'opció «config» dins del fitxer de configuració\n"
 
-#: main.c:1127
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "No es pot obrir el fitxer de configuració  «%s»: %s\n"
 
-#: main.c:1143
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Mode de compressió no vàlid «%s»\n"
 
-#: main.c:1164
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Falten els dos punts a l'opció resolve\n"
 
-#: main.c:1169
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "No s'ha pogut assignar memòria\n"
 
-#: main.c:1249 main.c:1258
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d massa petit\n"
 
-#: main.c:1288
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2476,133 +2514,133 @@ msgstr ""
 "l'opció --no-http-keepalive. Si això ajuda informeu a <openconnect-"
 "devel@lists.infradead.org>.\n"
 
-#: main.c:1294
+#: main.c:1304
 #, c-format
 msgid ""
 "The --no-cert-check option was insecure and has been removed.\n"
 "Fix your server's certificate or use --servercert to trust it.\n"
 msgstr ""
 
-#: main.c:1311
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Longitud de cua zero no permesa; s'està usant 1\n"
 
-#: main.c:1325
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "Versió d'OpenConnect %s\n"
 
-#: main.c:1358
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Mode de testimoni de programari «%s»  no vàlid\n"
 
-#: main.c:1368
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Identitat del sistema operatiu «%s» no vàlida\n"
 
-#: main.c:1401
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Massa arguments a la línia d'ordres\n"
 
-#: main.c:1404
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "No heu especificat servidor\n"
 
-#: main.c:1420
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 "Aquesta versió d'openconnect ha estat muntada sense suport per libproxy\n"
 
-#: main.c:1449
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Error en obrir el conducte «cmd»\n"
 
-#: main.c:1482
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Error per a obtenir la galeta WebVPN\n"
 
-#: main.c:1503
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "La creació de la connexió SSL ha fallat\n"
 
-#: main.c:1515
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "La configuració de DTLS ha fallat; s'està usant SSL al seu lloc\n"
 
-#: main.c:1535
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Connectat com a %s%s%s, s'està utilitzant %s%s\n"
 
-#: main.c:1544
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Cap argument --script proporcionat; DNS i encaminament no estan configurats\n"
 
-#: main.c:1546
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Mireu http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1559
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Errada per a obrir «%s» per escriure: %s\n"
 
-#: main.c:1571
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "S'està continuant al fons; PID %d\n"
 
-#: main.c:1588
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Torna a connectar la sol·licitud de l'usuari\n"
 
-#: main.c:1596
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "La galeta ha estat rebutjada en la reconnexió; s'està sortint.\n"
 
-#: main.c:1600
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Sessió acabada pel servidor; s'està sortint.\n"
 
-#: main.c:1604
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Usuari cancel·lat (SIGINT); s'està sortint.\n"
 
-#: main.c:1608
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Usuari desconnectat de la sessió (SIGHUP); s'està sortint.\n"
 
-#: main.c:1612
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Error desconegut; s'està sortint.\n"
 
-#: main.c:1631
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Error per a obrir %s per escriure: %s\n"
 
-#: main.c:1639
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Error en escriure a config %s: %s\n"
 
-#: main.c:1698
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "El certificat del servidor SSL no concorda: %s\n"
 
-#: main.c:1717
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2613,101 +2651,101 @@ msgstr ""
 "El certificat del servidor VPN  «%s» ha fallat la verificació.\n"
 "Motiu: %s\n"
 
-#: main.c:1720
+#: main.c:1730
 #, c-format
 msgid ""
 "To trust this server in future, perhaps add this to your command line:\n"
 msgstr ""
 
-#: main.c:1721
+#: main.c:1731
 #, c-format
 msgid "    --servercert %s\n"
 msgstr ""
 
-#: main.c:1726
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Entreu «%s» per acceptar, «%s» per avortar; qualsevol altra cosa per mostrar:"
 
-#: main.c:1727 main.c:1745
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "No"
 
-#: main.c:1727 main.c:1733
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "Sí"
 
-#: main.c:1754
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Resum de la clau del servidor: %s\n"
 
-#: main.c:1788
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "La tria d'autenticació «%s» concorda amb múltiples opcions\n"
 
-#: main.c:1791
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "La tria d'autenticació «%s» no està disponible\n"
 
-#: main.c:1812
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "L'entrada de l'usuari és requerida en mode no interactiu\n"
 
-#: main.c:1989
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Error en obrir el fitxer testimoni per escriptura: %s\n"
 
-#: main.c:1997
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Error en escriure el testimoni: %s\n"
 
-#: main.c:2043 main.c:2064
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "El testimoni tou de la cadena és no vàlid\n"
 
-#: main.c:2046
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "No es pot obrir el fitxer ~/.stokenrc\n"
 
-#: main.c:2049
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect ha sigut muntat sense suport per libstoken\n"
 
-#: main.c:2052
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Errada general en libstoken\n"
 
-#: main.c:2067
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect ha sigut muntat sense suport per liboath\n"
 
-#: main.c:2070
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Errada general en liboath\n"
 
-#: main.c:2081
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "El testimoni Yubikey no s'ha trobat\n"
 
-#: main.c:2084
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "OpenConnect ha sigut muntat sense suport per Yubikey\n"
 
-#: main.c:2087
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Errada general en Yubikey: %s\n"
@@ -2722,16 +2760,16 @@ msgstr "La configuració del script del controlador de xarxa ha fallat\n"
 msgid "Set up tun device failed\n"
 msgstr "La configuració del dispositiu del controlador de xarxa ha fallat\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "El cridador ha aturat la connexió\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Sense treball que fer; dormint durant %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "EsperantMultiplesObjectes ha fallat: %s\n"
@@ -2804,7 +2842,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "S'està generant el codi testimoni TOTP OATH\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "S'està generant el codi testimoni HOTP OATH\n"
 
@@ -2936,142 +2974,226 @@ msgstr "S'ha obtingut el missatge KMP  %d de mida %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Rebuts no-ESP TLVs (grup %d) en la negociació ESP KMP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Error en crear la sol·licitud de negociació oNCP\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Escrit curt en la negociació oNCP\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Llegits %d bytes del registre SSL\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 "Resposta inesperada de mida %d després del paquet de nom de l'amfitrió\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 "La resposta del servidor al paquet de nom de l'amfitrió és l'error 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Paquet no vàlid mentre s'està esperant a KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Esperat el missatge 301 KMP del servidor però s'ha obtingut %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "El missatge 301 de KMP del servidor és massa llarg (%d bytes)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "S'ha obtingut el missatge 301 de KMP de mida %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "No s'ha pogut llegir la longitud del registre de continuació\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "El registre de %d bytes addicionals és massa llarg; es farà de %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "No s'ha pogut llegir el registre de continuació de longitud %d\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Llegeix %d bytes addicionals del missatge 301 de KMP\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Error en negociar les claus ESP\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "entrada nova"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "sortida nova"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "S'està ignorant les claus ESP mentre el suport ESP no estigui disponible per "
 "a aquest muntatge\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Llegeix sols 1 byte del camp de longitud oNCP\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "La connexió del servidor ha acabat (sessió expirada)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "La connexió del servidor ha acabat (motiu: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "El servidor ha enviat un registre oNCP de longitud zero\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "S'està rebent un missatge %d d'entrada KMP de mida %d (rebut %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 "S'està continuant al missatge %d KMP de procés amb mida %d (rebut %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Paquet de dades no reconegudes\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Missatge KMP %d desconegut de mida %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d bytes més sense rebre\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Paquet de sortida:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "S'ha enviat habilitació ESP de control de paquets\n"
 
-#: openconnect-internal.h:1049 openconnect-internal.h:1057
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "ERROR: %s() cridada amb UTF-8 no vàlida de l'argument «%s»\n"
 
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Error en crear ASN.1 SSL_SESSION per a OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "OpenSSL ha fallat en analitzar ASN.1 SSL_SESSION\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "La inicialització de la sessió DTLSv1 ha fallat\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "La inicialització de CTX DTLSv1 ha fallat\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr "L'establiment de la versió DTLS CTX ha fallat\n"
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "La configuració de la llista de xifrat DTLS ha fallat\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "No hi ha sols un xifrat DTLS\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() ha fallat amb un protocol antic amb versió 0x%x\n"
+"Esteu utilitzant una versió de OpenSSL més vella que 0.9.8m?\n"
+"Mireu http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Useu l'opció --no-dtls a la línia d'ordres per evitar aquest missatge\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+"Establerta la connexió DTLS (utilitzant OpenSSL). Entorn de xifrat %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"La vostra OpenSSL és més antiga que una que heu muntat abans, per això DTLS "
+"pot fallar!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Això és degut a que el vostre OpenSSL està trencat\n"
+"Mireu http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "L'encaixada DTLS ha fallat: %d\n"
+
 #: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Error en inicialitzar el xifrat ESP:\n"
@@ -3167,7 +3289,7 @@ msgstr ""
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "Contingut del certificat X.509 no recuperat per libp11\n"
 
-#: openssl-pkcs11.c:412 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Error en instal·lar el certificat al context OpenSSL\n"
 
@@ -3218,263 +3340,263 @@ msgstr "L'afegit de la clau de PKCS#11 ha fallat\n"
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Aquesta versió d'OpenConnect ha sigut muntada sense suport PKCS#11\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Error en escriure al sòcol SSL\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Error en llegir del sòcol SSL\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Error %d de lectura SSL (el servidor probablement ha tancat la connexió); "
 "s'està tornant a connectar\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write ha fallat: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Tipus %d  de sol·licitud UI SSL no gestionat\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Contrasenya PEM massa gran (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Extra cert de %s: «%s»\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "L'anàlisi PKCS#12 ha fallat (mireu amunt els errors)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 no conté cap certificat!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 no conté cap clau privada!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "No es pot carregar l'enginy TPM.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Error en iniciar l'enginy TPM\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Error en configurar la contrasenya SRK TPM\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Error en carregar la clau privada TPM\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "L'afegit de la clau de TPM a fallat\n"
 
-#: openssl.c:670 openssl.c:818
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Error en obrir el fitxer certificat %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "La carrega del certificat ha fallat\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Error en processar tots els certificats suportats. S'està intentant de tota "
 "manera...\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "Fitxer PEM"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Error en crear BIO per a l'element «%s» del magatzem de claus\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "La carrega de la clau privada ha fallat (contrasenya dolenta? )\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "La carrega de la clau privada ha fallat (mireu amunt els errors)\n"
 
-#: openssl.c:841
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Error en carregar el certificat X509 del magatzem de claus\n"
 
-#: openssl.c:847
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Error en utilitzar el certificat X509 del magatzem de claus\n"
 
-#: openssl.c:879
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Error en utilitzar la clau privativa del magatzem de claus\n"
 
-#: openssl.c:895
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Error en obrir el fitxer %s de la clau privativa: %s\n"
 
-#: openssl.c:915 openssl.c:930 openssl.c:951 openssl.c:1017
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "La carrega de la clau privativa ha fallat\n"
 
-#: openssl.c:1011
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr "No s'ha pogut convertir PKCS#8 a OpenSSL EVP_PKEY\n"
 
-#: openssl.c:1028
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Errada en identificar el tipus de clau privativa en «%s»\n"
 
-#: openssl.c:1190
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Coincideix el nom alternatiu DNS «%s»\n"
 
-#: openssl.c:1197
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "No hi ha concordances per al nom alternatiu «%s»\n"
 
-#: openssl.c:1211
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 "El certificat té un nom alternatiu GEN_IPADD amb la longitud amb errors %d\n"
 
-#: openssl.c:1222 openssl.c:1367
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Coincideix %s amb l'adreça «%s»\n"
 
-#: openssl.c:1229
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "No hi ha concordances per l'adreça %s amb «%s»\n"
 
-#: openssl.c:1271
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI «%s» no té un camí buit;  s'està ignorant\n"
 
-#: openssl.c:1276
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Coincideix URI «%s»\n"
 
-#: openssl.c:1287
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "No hi ha concordances per URI «%s»\n"
 
-#: openssl.c:1302
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "No hi ha nom alternatiu al certificat parell trobat «%s»\n"
 
-#: openssl.c:1310
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "No hi ha nom de l'assumpte al certificat del parell!\n"
 
-#: openssl.c:1330
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Error en analitzar el nom de l'assumpte al certificat del parell\n"
 
-#: openssl.c:1337
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "L'assumpte del certificat del parell no coincideix ('%s' != '%s')\n"
 
-#: openssl.c:1342 openssl.c:1375
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "El nom de l'assumpte del certificat del parell coincideix «%s»\n"
 
-#: openssl.c:1437
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Extra cert del certificat del fitxer: «%s»\n"
 
-#: openssl.c:1575
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Error al camp notAfter del certificat del client\n"
 
-#: openssl.c:1588
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1640
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr "Ha fallat la creació de TLSv1 CTX\n"
 
-#: openssl.c:1655
+#: openssl.c:1705
 msgid "SSL certificate and key do not match\n"
 msgstr ""
 
-#: openssl.c:1700
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Error en llegir certificats del fitxer CA «%s»\n"
 
-#: openssl.c:1733
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Error en obrir el fitxer CA «%s»\n"
 
-#: openssl.c:1793
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "La connexió SSL ha fallat\n"
 
-#: openssl.c:1954
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Error en calcular HMAC OATH\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Descarta la divisió dolenta inclosa: «%s»\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Descarta la divisió dolenta exclosa: «%s»\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Error en engendrar el script  «%s» per %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "El script «%s» ha acabat de forma anòmala (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "El script «%s» ha retornat l'error %d\n"
@@ -3788,86 +3910,98 @@ msgstr "Format de PIN no vàlid; torneu a intentar.\n"
 msgid "Generating RSA token code\n"
 msgstr "S'està generant el codi de testimoni RSA\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Error en accedir a la clau de registre per als adaptadors de xarxa\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "S'està ignorant la interfície TAP no concordant «%s»\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 "No s'han trobat adaptadors TAP per Windows. Està el controlador instal·lat?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Error en obrir %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "S'ha obert el dispositiu controlador de xarxa %s\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Error en obtindre la versió del controlador TAP: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Error: El controlador TAP de Windows  v9.9 o superior és requerit (s'ha "
 "trobat %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Error en configurar l'adreça IP TAP: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Error en configurar l'estat del medi TAP: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "El dispositiu TAP ha avortat la connectivitat. S'està desconnectant.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Error en llegir del dispositiu TAP: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Error en completar la lectura des del dispositiu TAP: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Escrits %ld bytes al controlador de xarxa\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "S'està esperant l'escriptura del controlador de xarxa...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Escrits %ld bytes al controlador de xarxa després d'esperar\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Error en escriure al dispositiu TAP: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "L'engendrat de scripts de túnel no està encara suportat en Windows\n"
 
diff --git a/po/ca@valencia.po b/po/ca@valencia.po
index b5a2ac81..1ad428a6 100644
--- a/po/ca@valencia.po
+++ b/po/ca@valencia.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Catalan (Valencian) (http://www.transifex.net/projects/p/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/crh.po b/po/crh.po
index bcc72e7f..52c85d98 100644
--- a/po/crh.po
+++ b/po/crh.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Crimean Turkish (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/cs.po b/po/cs.po
index 1e99d7f8..0497d0b3 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -4236,18 +4236,3 @@ msgstr "příkaz výpočtu"
 #: yubikey.c:608
 msgid "Unrecognised response from Yubikey when generating tokencode\n"
 msgstr "Nerozpoznaná odpověď od Yubikey při generování kódu tokenu\n"
-
-#~ msgid "using OpenSSL"
-#~ msgstr "používá se OpenSSL"
-
-#~ msgid "Failed to recv DPD request (%d): %s\n"
-#~ msgstr "Nepodařilo se přijmout požadavek DPD (%d): %s\n"
-
-#~ msgid "Failed to send DPD request (%d): %s\n"
-#~ msgstr "Nepodařilo se poslat požadavek DPD (%d): %s\n"
-
-#~ msgid "Too long time in MTU detect loop; bailing out.\n"
-#~ msgstr "Příliš dlouhé trvání detekční smyčky MTU, ukončuje se.\n"
-
-#~ msgid "SSL operation cancelled\n"
-#~ msgstr "Spojení SSL bylo zrušeno\n"
diff --git a/po/cy.po b/po/cy.po
index 22bf9570..0aec74fd 100644
--- a/po/cy.po
+++ b/po/cy.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Welsh (http://www.transifex.com/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/da.po b/po/da.po
index 202fc4c7..a3d5096c 100644
--- a/po/da.po
+++ b/po/da.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Danish (http://www.transifex.net/projects/p/meego/team/da/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/de.po b/po/de.po
index 7d8379f3..3db29608 100644
--- a/po/de.po
+++ b/po/de.po
@@ -4319,18 +4319,3 @@ msgstr "Berechnen-Befehl"
 #: yubikey.c:608
 msgid "Unrecognised response from Yubikey when generating tokencode\n"
 msgstr "Nicht erkannte Antwort von Yubikey bei Erstellung des Token-Codes\n"
-
-#~ msgid "SSL operation cancelled\n"
-#~ msgstr "SSL-Operation abgebrochen\n"
-
-#~ msgid "Too long time in MTU detect loop; bailing out.\n"
-#~ msgstr "Zu lange Zeit in MTU-Erkennungsschleife; Abbruch.\n"
-
-#~ msgid "Failed to send DPD request (%d): %s\n"
-#~ msgstr "DPD-Anfrage konnte nicht gesendet werden (%d): %s\n"
-
-#~ msgid "Failed to recv DPD request (%d): %s\n"
-#~ msgstr "DPD-Anfrage konnte nicht empfangen werden (%d): %s\n"
-
-#~ msgid "using OpenSSL"
-#~ msgstr "OpenSSL wird verwendet"
diff --git a/po/dz.po b/po/dz.po
index 0955774e..566cc042 100644
--- a/po/dz.po
+++ b/po/dz.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Dzongkha (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/el.po b/po/el.po
index 76fe54f6..5c08bf26 100644
--- a/po/el.po
+++ b/po/el.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Greek (http://www.transifex.net/projects/p/meego/team/el/)\n"
@@ -170,7 +170,7 @@ msgstr "Ζητήθηκε κωδικός πρόσβασης, αλλά έχει ο
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Αποτυχία ανοίγματος σύνδεσης HTTPS σε %s\n"
@@ -306,555 +306,485 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "ΣΦΑΛΜΑ: Αδύνατη η αρχικοποίηση υποδοχών\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Σφάλμα κατά την προσκόμιση απάντησης HTTPS\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Η υπηρεσία VPN δεν είναι διαθέσιμη· αιτία: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Λήψη ακατάλληλης απάντησης HTTP CONNECT: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Λήψη απάντησης CONNECT: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Χωρίς μνήμη για επιλογές\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<παραλειπόμενο>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 "Το αναγνωριστικό συνεδρίας X-DTLS δεν είναι 64 χαρακτήρες· είναι: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Άγνωστη κωδικοποίηση περιεχομένου CSTP %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Δεν ελήφθη MTU. Ματαίωση\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Δεν ελήφθη διεύθυνση IP. Ματαίωση\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 "Η επανασύνδεση έδωσε διαφορετική κληρονομημένη διεύθυνση IP (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "Η επανασύνδεση έδωσε διαφορετική κληρονομημένη μάσκα δικτύου IP (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Η επανασύνδεση έδωσε διαφορετική διεύθυνση IPv6 (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Η επανασύνδεση έδωσε διαφορετική μάσκα δικτύου IPv6 (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "Συνδέθηκε το CSTP. DPD %d, διατήρηση σύνδεσης %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Αποτυχία ρύθμισης συμπίεσης\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Αποτυχία κατανομής ενδιάμεσης μνήμης συμπίεσης\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "Αποτυχία αποσυμπίεσης\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "Αποτυχία συμπίεσης %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 "Αναπάντεχο μήκος πακέτου. Η ανάγνωση_SSL επέστρεψε %d αλλά το πακέτο είναι\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Λήψη αιτήματος DPD CSTP\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Λήψη απάντησης DPD CSTP\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Λήψη διατήρησης σύνδεσης του CSTP\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Λήψη πακέτου ασυμπίεστων δεδομένων από %d οκτάδες\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Λήψη αποσύνδεσης διακομιστή: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Λήψη συμπιεσμένου πακέτου! κατάσταση συμπίεσης\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "Λήψη πακέτου τερματισμού διακομιστή\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Άγνωστο πακέτο %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "Το SSL έγραψε υπερβολικά λίγες οκτάδες! Ζητήθηκαν %d, στάλθηκαν %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Αναμενόμενη αλλαγή κλειδιού CSTP\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "Η αναγνώριση νεκρού ομότιμου CSTP ανίχνευσε νεκρό ομότιμο!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Αποτυχία επανασύνδεσης\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Αποστολή DPD CSTP\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Αποστολή διατήρησης σύνδεσης CSTP\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Αποστολή πακέτου ασυμπίεστων δεδομένων από %d οκτάδες\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Αποστολή πακέτου BYE: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Αποτυχία αρχικοποίησης της συνεδρίας DTLSv1\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Αποτυχία αρχικοποίησης του DTLSv1 CTX\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Αποτυχία ορισμού λίστας κρυπτογράφησης DTLS\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Δεν είναι ακριβώς μία κρυπτογράφηση DTLS\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"Αποτυχία του SSL_set_session() με την παλιά έκδοση πρωτοκόλλου 0x%x\n"
-"Χρησιμοποιείτε έκδοση του OpenSSL παλιότερη από 0.9.8m;\n"
-"Δείτε http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Χρησιμοποιήστε την επιλογή γραμμής εντολών --no-dtls για την αποφυγή αυτού "
-"του μηνύματος\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "Επίτευξη σύνδεσης DTLS (με χρήση του OpenSSL). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Το OpenSSL σας είναι παλιότερο από αυτό στο οποίο δομείτε, έτσι το DTLS "
-"μπορεί να αποτύχει!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "Λήξη χρόνου χειραψίας DTLS\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Αυτό συμβαίνει προφανώς επειδή το OpenSSL σας έχει αλλοιωθεί\n"
-"Δείτε http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "Αποτυχία χειραψίας DTLS: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Άγνωστες παράμετροι DTLS για το ζητούμενο CipherSuite '%s'\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Αποτυχία ορισμού προτεραιότητας DTLS: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Αποτυχία ορισμού παραμέτρων συνεδρίας DTLS: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Αποτυχία ορισμού DTLS MTU: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Επίτευξη σύνδεσης DTLS (με χρήση του GnuTLS). Ciphersuite %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Αποτυχία χειραψίας DTLS: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Χωρίς διεύθυνση DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Ο διακομιστής δεν προσέφερε επιλογή κρυπτογράφησης DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Χωρίς DTLS κατά τη σύνδεση μέσα από μεσολαβητή\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Επιλογή DTLS %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "Αρχικοποίηση DTLS. DPD %d, διατήρηση σύνδεσης %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Προσπάθεια νέας σύνδεσης DTLS\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Ελήφθη πακέτο DTLS 0x%02x από %d οκτάδες\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Λήψη αιτήματος DPD DTLS\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Αποτυχία αποστολής απάντησης DPD. Αναμένεται αποσύνδεση\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Λήψη απάντησης DPD DTLS\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Λήψη διατήρησης σύνδεσης του DTLS\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Άγνωστος τύπος πακέτου DTLS %02x, μήκος %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Αναμενόμενη αλλαγή κλειδιού DTLS\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "Η αναγνώριση νεκρού ομότιμου DTLS ανίχνευσε νεκρό ομότιμο!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Αποστολή DPD DTLS\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Αποτυχία αποστολής αιτήματος DPD. Αναμένεται αποσύνδεση\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Αποστολή διατήρησης σύνδεσης DTLS\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 "Αποτυχία αποστολής αιτήματος διατήρησης σύνδεσης. Αναμένεται αποσύνδεση\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Λήψη άγνωστου πακέτου (μήκους %d): %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "Το DTLS έλαβε σφάλμα εγγραφής %d. Υποχώρηση σε SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "Το DTLS έλαβε σφάλμα εγγραφής %s. Υποχώρηση σε SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Αποστολή πακέτου DTLS από %d οκτάδες· η αποστολή DTLS επέστρεψε %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgstr ""
+
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -956,6 +886,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Άγνωστες παράμετροι DTLS για το ζητούμενο CipherSuite '%s'\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Αποτυχία ορισμού προτεραιότητας DTLS: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Αποτυχία ορισμού παραμέτρων συνεδρίας DTLS: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Αποτυχία ορισμού DTLS MTU: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Επίτευξη σύνδεσης DTLS (με χρήση του GnuTLS). Ciphersuite %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "Λήξη χρόνου χειραψίας DTLS\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Αποτυχία χειραψίας DTLS: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -976,7 +997,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -995,7 +1016,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Ακύρωση εγγραφής SSL\n"
 
@@ -1004,491 +1025,495 @@ msgstr "Ακύρωση εγγραφής SSL\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Αποτυχία εγγραφής στην υποδοχή SSL: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Ακύρωση ανάγνωσης SSL\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Αποτυχία ανάγνωσης από την υποδοχή SSL: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Σφάλμα ανάγνωσης SSL: %s· επανασυνδέεται.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "Αποτυχία αποστολής SSL: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Αδύνατη η εξαγωγή χρόνου λήξης του πιστοποιητικού\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Το πιστοποιητικό πελάτη έχει λήξει στις"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Το πιστοποιητικό πελάτη λήγει σύντομα στις"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Αποτυχία φόρτωσης στοιχείου '%s' από την αποθήκη κλειδιών: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Αποτυχία ανοίγματος αρχείου κλειδιού/πιστοποιητικού %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Αποτυχία stat αρχείου κλειδιού/πιστοποιητικού %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Αποτυχία κατανομής ενδιάμεσης μνήμης πιστοποιητικού\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Αποτυχία ανάγνωσης πιστοποιητικού στη μνήμη: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Αποτυχία ρύθμισης δομής δεδομένων PKCS#12: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Αποτυχία αποκρυπτογράφησης αρχείου πιστοποιητικού PKCS#12\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Εισαγωγή συνθηματικού PKCS#12:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Αποτυχία επεξεργασίας αρχείου PKCS#12: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Αποτυχία φόρτωσης πιστοποιητικού PKCS#12: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Αποτυχία εισαγωγής πιστοποιητικού X509: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Αποτυχία ρύθμισης πιστοποιητικού PKCS#11: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Αδύνατη η αρχικοποίηση του κατακερματισμού MD5: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "Σφάλμα κατακερματισμού MD5: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 "Λείπουν πληροφορίες DEK: η κεφαλίδα από το κρυπτογραφημένο κλειδί OpenSSL\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Αδύνατος ο προσδιορισμός τύπου κρυπτογράφησης PEM\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Μη υποστηριζόμενος τύπος κρυπτογράφησης PEM: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Άκυρο αλάτι σε κρυπτογραφημένο αρχείο PEM\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Σφάλμα κρυπτογραφημένου αρχείου PEM με αποκωδικοποίηση βάση64: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Το κρυπτογραφημένο αρχείο PEM είναι υπερβολικά σύντομο\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 "Αποτυχία αρχικοποίησης κρυπτογράφησης για αποκρυπτογράφηση αρχείου PEM: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Αποτυχία αποκρυπτογράφησης κλειδιού PEM: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Αποτυχία αποκρυπτογράφησης κλειδιού PEM\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Εισαγωγή συνθηματικού PEM:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Αυτό το δυαδικό δημιουργήθηκε χωρίς υποστήριξη PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Χρήση πιστοποιητικού PKCS#11 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Σφάλμα κατά τη φόρτωση πιστοποιητικού από PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Χρήση αρχείου πιστοποιητικού %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "Το αρχείο PKCS#11 δεν περιείχε κανένα πιστοποιητικό\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Δεν βρέθηκε κανένα πιστοποιητικό στο αρχείο"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Αποτυχία φόρτωσης πιστοποιητικού: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Σφάλμα κατά την αρχικοποίηση δομής ιδιωτικού κλειδιού: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Σφάλμα κατά την αρχικοποίηση δομής κλειδιού PKCS#11: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Σφάλμα κατά την εισαγωγή URL PKCS#11 %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Χρήση κλειδιού %s PKCS#11\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 "Σφάλμα εισαγωγής του κλειδιού PKCS#11 στην δομή ιδιωτικού κλειδιού: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Χρήση αρχείου ιδιωτικού κλειδιού %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Αυτή η έκδοση του openconnect δομήθηκε χωρίς υποστήριξη TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Αποτυχία ερμηνείας του αρχείου PEM\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Αποτυχία φόρτωσης ιδιωτικού κλειδιού PKCS#1: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Αποτυχία φόρτωσης ιδιωτικού κλειδιού ως PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Αποτυχία αποκρυπτογράφησης αρχείου πιστοποιητικού PKCS#8\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Αποτυχία προσδιορισμού τύπου ιδιωτικού κλειδιού %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Εισαγωγή συνθηματικού PKCS#8:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Αποτυχία λήψης αναγνωριστικού κλειδιού: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Σφάλμα υπογραφής δεδομένων ελέγχου με ιδιωτικό κλειδί: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Σφάλμα εγκυρότητας υπογραφής στο πιστοποιητικό: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 "Δεν βρέθηκε κανένα πιστοποιητικό SSL που να ταιριάζει με το ιδιωτικό κλειδί\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Χρήση πιστοποιητικού πελάτη '%s'\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Αποτυχία ορισμού λίστας ανάκλησης πιστοποιητικού: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Αποτυχία κατανομής μνήμης για πιστοποιητικό\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "ΠΡΟΕΙΔΟΠΟΙΗΣΗ: Το GnuTLS επέστρεψε εσφαλμένα πιστοποιητικά εκδότη· η "
 "επικύρωση μπορεί να αποτύχει!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "Ελήφθη επόμενο CA '%s' από το PKCS11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Αποτυχία κατανομής μνήμης για υποστήριξη πιστοποιητικών\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Προσθήκη υποστήριξης CA '%s'\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Αποτυχία ορισμού πιστοποιητικού: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Ο διακομιστής δεν παρουσίασε κανένα πιστοποιητικό\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Σφάλμα αρχικοποίησης δομής πιστοποιητικού X509\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Σφάλμα εισαγωγής πιστοποιητικού διακομιστή\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Σφάλμα ελέγχου κατάστασης πιστοποιητικού διακομιστή\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "Το πιστοποιητικό ανακλήθηκε"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "Ο υπογράφων δεν βρέθηκε"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "Ο υπογράφων δεν έχει πιστοποιητικό CA"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "Επισφαλής αλγόριθμος"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "Το πιστοποιητικό δεν έχει ακόμη ενεργοποιηθεί"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "Το πιστοποιητικό έληξε"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "Αποτυχία επιβεβαίωσης υπογραφής"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "Το πιστοποιητικό δεν ταιριάζει με το όνομα του οικοδεσπότη."
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Αποτυχία επιβεβαίωσης πιστοποιητικού διακομιστή: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Αποτυχία κατανομής μνήμης για πιστοποιητικά αρχείου ca\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Αποτυχία ανάγνωσης πιστοποιητικών από αρχείο ca: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Αποτυχία ανοίγματος αρχείου CA '%s': %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Αποτυχία φόρτωσης πιστοποιητικού. Ματαίωση.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Διαπραγμάτευση SSL με %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Ακύρωση σύνδεσης SSL\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Αποτυχία σύνδεσης SSL: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS μη μοιραία επιστροφή κατά τη διάρκεια χειραψίας: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Σύνδεση με HTTPS στο %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Διαπραγμάτευση SSL με %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "Απαιτείται PIN για το %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Εσφαλμένο PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Αυτή είναι η τελική προσπάθεια πριν το κλείδωμα!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Μόνο λίγες προσπάθειες έμειναν πριν το κλείδωμα!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Εισαγωγή PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1683,7 +1708,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1701,239 +1726,239 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Χωρίς μνήμη για κατανομή μπισκότων\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Αποτυχία ανάλυσης απάντησης HTTP '%s'\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Λήψη απάντησης HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Σφάλμα επεξεργασίας απόκρισης HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Παράβλεψη άγνωστης γραμμής απάντησης HTTP '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Προσφορά άκυρου μπισκότου: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Αποτυχία επικύρωσης πιστοποιητικού SSL\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Το σώμα της απόκρισης έχει αρνητικό μέγεθος (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Άγνωστη κωδικοποίηση μεταφοράς: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "Σώμα HTTP %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Σφάλμα κατά την ανάγνωση σώματος απάντησης HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Σφάλμα κατά την προσκόμιση κεφαλίδας τμήματος\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Σφάλμα κατά την προσκόμιση σώματος απάντησης HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Σφάλμα στην τμηματική αποκωδικοποίηση. Αναμενόταν '', ελήφθη '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Αδύνατη η λήψη σώματος HTTP 1.0 χωρίς κλείσιμο της σύνδεσης\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Αποτυχία ανάλυσης ανακατεύθυνσης URL '%s': %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Αδύνατη η παρακολούθηση ανακατεύθυνσης σε μη https URL '%s'\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Αποτυχία κατανομής νέας διαδρομής για σχετική ανακατεύθυνση: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Αναπάντεχο αποτέλεσμα %d από διακομιστή\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "Δόθηκε αίτημα"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "Γενική αποτυχία"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "Η σύνδεση δεν επιτρέπεται από το σύνολο των κανόνων."
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "Απροσπέλαστο δίκτυο"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "Απροσπέλαστος οικοδεσπότης"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "Άρνηση σύνδεσης από τον οικοδεσπότη προορισμού"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "Έληξε το TTL"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "Εντολή που δεν υποστηρίζεται / σφάλμα πρωτοκόλλου"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "Δεν υποστηρίζεται αυτός ο τύπος διεύθυνσης"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 "Σφάλμα κατά την εγγραφή αιτήματος πιστοποίησης σε μεσολαβητή SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 "Σφάλμα κατά την ανάγνωση απάντησης πιστοποίησης από τον μεσολαβητή SOCKS: "
 "%s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Αναπάντεχη απάντηση πιστοποίησης από τον μεσολαβητή SOCKS: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Αίτημα σύνδεσης μεσολαβητή SOCKS στο %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Σφάλμα κατά την εγγραφή αιτήματος σύνδεσης σε μεσολαβητή SOCKS: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 "Σφάλμα κατά την ανάγνωση απάντησης σύνδεσης από τον μεσολαβητή SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Αναπάντεχη απάντηση σύνδεσης από τον μεσολαβητή SOCKS: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Σφάλμα μεσολαβητή SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Σφάλμα μεσολαβητή SOCKS %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Αναπάντεχος τύπος διεύθυνσης %02x σε απάντηση σύνδεσης SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Αίτημα σύνδεσης μεσολαβητή HTTP στο %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Αποτυχία αιτήματος αποστολής μεσολαβητή: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Άγνωστος τύπος μεσολαβητή '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Υποστηρίζονται μόνο μεσολαβητές http ή socks(5)\n"
 
@@ -1946,70 +1971,83 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Δόμηση στη βιβλιοθήκη SSL χωρίς υποστήριξη DTLS Cisco\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Αποτυχία ανάλυσης διακομιστή URL '%s'.\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Μόνο https:// επιτρέπονται για διακομιστή URL\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Χωρίς χειριστή μορφής· αδύνατη η πιστοποίηση.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Αποτυχία κατανομής για συμβολοσειρά από την τυπική είσοδο\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Χρήση του OpenSSL. Τα γνωρίσματα παρουσιάζουν:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Χρήση του GnuTLS. Τα γνωρίσματα παρουσιάζουν:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "Το OpenSSL ENGINE δεν είναι παρόν"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "χρησιμοποιώντας OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2019,31 +2057,31 @@ msgstr ""
 "ΠΡΟΕΙΔΟΠΟΙΗΣΗ: Χωρίς υποστήριξη DTLS σε αυτό το δυαδικό. Η απόδοση θα "
 "εξασθενίσει.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (τυπική είσοδος)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Χρήση: openconnect [επιλογές] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2052,308 +2090,308 @@ msgstr ""
 "Άνοιγμα πελάτη για Cisco AnyConnect VPN, έκδοση %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Ανάγνωση επιλογών από το αρχείο ρυθμίσεων"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Συνέχιση στο παρασκήνιο μετά την έναρξη"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Εγγραφή του PID του δαίμονα σε αυτό το αρχείο"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Χρήση του πιστοποιητικού πελάτη SSL CERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Προειδοποίηση όταν ο χρόνος ζωής του πιστοποιητικού < ΗΜΕΡΕΣ"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Χρήση αρχείου ιδιωτικού κλειδιού SSL KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Χρήση μπισκότου WebVPN COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Ανάγνωση μπισκότου από την τυπική είσοδο"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Ενεργοποίηση συμπίεσης (προεπιλογή)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Απενεργοποίηση συμπίεσης"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Ορισμός ελάχιστου διαστήματος αναγνώρισης νεκρού ομότιμου"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Ορισμός σύνδεσης ομάδας χρηστών"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Εμφάνιση κειμένου βοήθειας"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Χρήση IFNAME για διεπαφή δρομολόγησης"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Χρήση του syslog για μηνύματα προόδου"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Πρόταξη χρονικής σήμανσης σε μηνύματα προόδου"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Απόρριψη προνομίων μετά τη σύνδεση"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Απόρριψη προνομίων κατά τη διάρκεια εκτέλεσης του CSD"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Εκτέλεση SCRIPT αντί για δυαδικό CSD"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Υπόδειξη διαδρομής MTU προς/από διακομιστή"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Ορισμός συνθηματικού κλειδιού ή TPM SRK PIN"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Το συνθηματικό του κλειδιού είναι fsid του συστήματος αρχείων"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Ορισμός διακομιστή μεσολάβησης"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Απενεργοποίηση μεσολαβητή"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Χρήση του libproxy για αυτόματη ρύθμιση του μεσολαβητή"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(ΣΗΜΕΙΩΣΗ: απενεργοποιήθηκε το libproxy σε αυτή τη δόμηση)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Απαιτείται τέλεια προώθηση μυστικότητας"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Λιγότερη έξοδος"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Ορισμός ορίου ουράς πακέτου σε LEN πακέτα"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Γραμμή εντολών κελύφους για χρήση ενός συμβατού με vpnc σεναρίου ρυθμίσεων"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "προεπιλογή"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Πέρασμα κυκλοφορίας σε πρόγραμμα 'σεναρίου', όχι tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Ορισμός ονόματος χρήστη της σύνδεσης"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Αναφορά αριθμού έκδοσης"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Περισσότερη έξοδος"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Αποτύπωση κυκλοφορίας πιστοποίησης HTTP (υπονοεί --verbose"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Αρχείο ρυθμίσεων XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Επιλέξτε επικύρωση επιλογής σύνδεσης"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Πιστοποίηση μόνο και εκτύπωση πληροφοριών σύνδεσης"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Προσκόμιση μόνο μπισκότου webvpn· όχι σύνδεση"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Εκτύπωση μπισκότου webvpn πριν την σύνδεση"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Αρχείο πιστοποίησης για επιβεβαίωση διακομιστή"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Μην ζητάτε συνδεσιμότητα IPv6"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Το OpenSSL κρυπτογραφεί για υποστήριξη του DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Απενεργοποίηση DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Απενεργοποίηση επαναχρησιμοποίησης σύνδεσης HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Απενεργοποίηση επικύρωσης κωδικού πρόσβασης/SecurID"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Να μην απαιτείται πιστοποιητικό SSL διακομιστή για να είναι έγκυρο"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Να μην προσπαθείτε πιστοποίηση XML POST"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Να μην αναμένεται είσοδος χρήστη· έξοδος αν απαιτείται"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Ανάγνωση κωδικού πρόσβασης από την τυπική είσοδο"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Τύποι διακριτικού λογισμικού: rsa, totp ή hotp"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Μυστικό διακριτικό λογισμικού"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 "(ΣΗΜΕΙΩΣΗ: απενεργοποίηση του libstoken (RSA SecurID) σε αυτή τη δόμηση)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Όριο χρόνου επαναπροσπάθειας σύνδεσης σε δευτερόλεπτα"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Δακτυλικό αποτύπωμα πιστοποιητικού SHA1 του διακομιστή"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Κεφαλίδα HTTP μεσολαβητή χρήστη: πεδίο"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Τύπος λειτουργικού (Λίνουξ, λίνουξ-64, win,...) για αναφορά"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Ορισμός τοπικής θύρας για αυτοδύναμα πακέτα DTLS"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Αποτυχία κατανομής συμβολοσειράς\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Αποτυχία λήψης γραμμής από το αρχείο ρυθμίσεων: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Άγνωστη επιλογή στη γραμμή %d: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Η επιλογή '%s' δεν παίρνει όρισμα στη γραμμή %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Η επιλογή '%s' απαιτεί όρισμα στη γραμμή %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2361,49 +2399,49 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Αποτυχία κατανομής δομής vpninfo\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Αδύνατη η χρήση της επιλογής 'config' μέσα στο αρχείο ρυθμίσεων\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Αδύνατο το άνοιγμα του αρχείου ρυθμίσεων '%s': %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "Το %d MTU είναι υπερβολικά μικρό\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2414,126 +2452,133 @@ msgstr ""
 "Αν αυτό βοηθά, παρακαλούμε αναφερθείτε στο <openconnect-devel@lists."
 "infradead.org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Δεν επιτρέπεται μήκος ουράς μηδέν· χρησιμοποιείται 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "Έκδοση OpenConnect %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Άκυρη κατάσταση διακριτικού λογισμικού \"%s\"\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Άκυρη ταυτότητα λειτουργικού \"%s\"\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Υπερβολικά ορίσματα στη γραμμή εντολών\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Δεν ορίστηκε διακομιστής\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Αυτή η έκδοση του openconnect δομήθηκε χωρίς υποστήριξη libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Σφάλμα κατά το άνοιγμα διοχέτευσης cmd\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Αποτυχία λήψης μπισκότου WebVPN\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Αποτυχία δημιουργίας σύνδεσης SSL\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Αποτυχία εγκατάστασης DTLS· χρήση SSL στη θέση του\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Δεν παρέχεται όρισμα --script· το DNS και η δρομολόγηση δεν είναι "
 "ρυθμισμένα\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Δείτε http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Αποτυχία ανοίγματος του '%s' για εγγραφή: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Συνέχιση στο παρασκήνιο, ταυτότητα διεργασίας (pid) %d.\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Αποτυχία ανοίγματος του %s για εγγραφή: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Αποτυχία εγγραφής ρύθμισης στο %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Το πιστοποιητικό SSL του διακομιστή δεν συμφωνεί: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2544,90 +2589,101 @@ msgstr ""
 "Αποτυχία επιβεβαίωσης πιστοποιητικού από τον διακομιστή VPN \"%s\".\n"
 "Αιτία: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Εισαγωγή '%s' για αποδοχή, '%s' για ματαίωση, ο,τιδήποτε άλλο για προβολή: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "όχι"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "ναι"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Η επιλογή πιστοποίησης \"%s\" ταιριάζει με πολλαπλές επιλογές\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Η επιλογή πιστοποίησης \"%s\" δεν είναι διαθέσιμη\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Η απαιτούμενη είσοδος χρήστη είναι σε μη διαδραστική κατάσταση\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Η συμβολοσειρά χαλαρού διακριτικού είναι άκυρη\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Αδύνατο το άνοιγμα του αρχείου ~/.stokenrc\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "Το OpenConnect δεν δομήθηκε με υποστήριξη libstoken\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Γενική αποτυχία στο libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "Το OpenConnect δεν δομήθηκε με υποστήριξη liboath\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Γενική αποτυχία στο libstoken\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2642,16 +2698,16 @@ msgstr "Αποτυχία ρύθμισης δέσμης ενεργειών tun\n"
 msgid "Set up tun device failed\n"
 msgstr "Αποτυχία εγκατάστασης συσκευής tun\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Ο καλών διέκοψε τη σύνδεση\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Χωρίς εργασία· ύπνος για %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2719,7 +2775,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "Δημιουργείται κώδικας διακριτικού TOTP OATH\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Δημιουργείται κώδικας διακριτικού OATH HOTP\n"
 
@@ -2851,504 +2907,622 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Αποτυχία αρχικοποίησης της συνεδρίας DTLSv1\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Αποτυχία αρχικοποίησης του DTLSv1 CTX\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Αποτυχία ορισμού λίστας κρυπτογράφησης DTLS\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Δεν είναι ακριβώς μία κρυπτογράφηση DTLS\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"Αποτυχία του SSL_set_session() με την παλιά έκδοση πρωτοκόλλου 0x%x\n"
+"Χρησιμοποιείτε έκδοση του OpenSSL παλιότερη από 0.9.8m;\n"
+"Δείτε http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Χρησιμοποιήστε την επιλογή γραμμής εντολών --no-dtls για την αποφυγή αυτού "
+"του μηνύματος\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "Επίτευξη σύνδεσης DTLS (με χρήση του OpenSSL). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Το OpenSSL σας είναι παλιότερο από αυτό στο οποίο δομείτε, έτσι το DTLS "
+"μπορεί να αποτύχει!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Αυτό συμβαίνει προφανώς επειδή το OpenSSL σας έχει αλλοιωθεί\n"
+"Δείτε http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Αποτυχία χειραψίας DTLS: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Αποτυχία εγγραφής στην υποδοχή SSL\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Αποτυχία ανάγνωσης από την υποδοχή SSL\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Σφάλμα ανάγνωσης SSL %d (ο διακομιστής προφανώς έκλεισε τη σύνδεση)· "
 "επανασυνδέεται.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "Αποτυχία εγγραφής_SSL: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Ο κωδικός πρόσβασης PEM είναι υπερβολικά μεγάλος (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Πρόσθετο πιστοποιητικό από το %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Αποτυχία ανάλυσης PKCS#12 (δείτε παραπάνω σφάλματα)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "Το PKCS#12 δεν περιείχε κανένα πιστοποιητικό!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "Το PKCS#12 δεν περιείχε κανένα ιδιωτικό κλειδί!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Αδύνατη η φόρτωση μηχανής TPM.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Αποτυχία αρχικοποίησης μηχανής TPM\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Αποτυχία ορισμού κωδικού πρόσβασης TPM SRK\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Αποτυχία φόρτωσης ιδιωτικού κλειδιού TPM\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Αποτυχία προσθήκης κλειδιού από το TPM\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Αποτυχία ανοίγματος αρχείου πιστοποιητικού %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Αποτυχία φόρτωσης πιστοποιητικού\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Αποτυχία δημιουργίας BIO για το στοιχείο αποθήκης κλειδιών '%s'\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Η φόρτωση ιδιωτικού κλειδιού απέτυχε (εσφαλμένο συνθηματικό;)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Αποτυχία φόρτωσης ιδιωτικού κλειδιού (δείτε τα παραπάνω σφάλματα)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Αποτυχία φόρτωσης πιστοποιητικού X509 από την αποθήκη κλειδιών\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Αποτυχία χρησιμοποίησης πιστοποιητικού X509 από την αποθήκη κλειδιών\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Αποτυχία χρήσης ιδιωτικού κλειδιού από την αποθήκη κλειδιών\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Αποτυχία ανοίγματος αρχείου ιδιωτικού κλειδιού %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Αποτυχία ταυτοποίησης τύπου ιδιωτικού κλειδιού στο '%s'\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Το εναλλακτικό όνομα του DNS '%s' συμφώνησε\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Χωρίς συμφωνία για το εναλλακτικό όνομα '%s'\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Το πιστοποιητικό έχει εναλλακτικό όνομα GEN_IPADD με πλαστό μήκος %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Συμφωνία με %s διεύθυνση '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Χωρίς συμφωνία για τη διεύθυνση %s '%s'\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "Το URI '%s' έχει μη κενή διαδρομή· παράβλεψη\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Συμφωνία με URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Χωρίς συμφωνία για το URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 "Κανένα εναλλακτικό όνομα στο πιστοποιητικό ομότιμου δεν ταίριαξε με το '%s'\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Χωρίς όνομα θέματος στο πιστοποιητικό ομότιμου!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Αποτυχία ανάλυσης ονόματος θέματος στο πιστοποιητικό ομότιμου\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Ασυμφωνία θέματος πιστοποιητικού ομότιμου ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Συμφωνία ονόματος θέματος πιστοποιητικού ομότιμου '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Πρόσθετο πιστοποιητικό από το cafile: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Σφάλμα στο πεδίο πιστοποιητικού πελάτη notAfter\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<σφάλμα>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Αποτυχία ανάγνωσης πιστοποιητικών από το αρχείο CA '%s'\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Αποτυχία ανοίγματος αρχείου CA '%s'\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Αποτυχία σύνδεσης SSL\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Απόρριψη εσφαλμένης διαίρεσης περιλαμβανομένου του: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Απόρριψη εσφαλμένης διαίρεσης αποκλειομένου του: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Αποτυχία παραγωγής σεναρίου '%s' για το %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Το σενάριο '%s' εξήλθε ανώμαλα (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Το σενάριο '%s' επέστρεψε σφάλμα %d\n"
@@ -3646,85 +3820,97 @@ msgstr "Άκυρη μορφή PIN· δοκιμάστε ξανά.\n"
 msgid "Generating RSA token code\n"
 msgstr "Δημιουργείται κώδικας διακριτικού RSA\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Δεν βρέθηκαν υποδοχείς Windows-TAP. Είναι εγκατεστημένος ο οδηγός;\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Αποτυχία ανοίγματος του %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Σφάλμα: Απαιτείται ο οδηγός TAP για Windows με έκδοση v9.9 ή μεγαλύτερη "
 "(βρέθηκε %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Αποτυχία ορισμού διεύθυνσης IP για το TAP : %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Αποτυχία ανάγνωσης από την συσκευή TAP: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Αποτυχία ολοκλήρωσης της ανάγνωσης από την συσκευή TAP: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Γράφτηκαν %ld bytes στο tun\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Αναμονή για εγγραφή στο tun...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Γράφτηκαν %ld bytes στο tun μετά την αναμονή\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Αποτυχία εγγραφής στην συσκευή TAP: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/en_CA.po b/po/en_CA.po
index 4af0642f..10059ca3 100644
--- a/po/en_CA.po
+++ b/po/en_CA.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: English (Canada) (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/en_GB.po b/po/en_GB.po
index 4fdeeed2..d13d322f 100644
--- a/po/en_GB.po
+++ b/po/en_GB.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-11-15 08:31+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: English (United Kingdom) (http://www.transifex.com/projects/p/"
@@ -172,7 +172,7 @@ msgstr "Asked for password but '--no-passwd' set\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Failed to open HTTPS connection to %s\n"
@@ -304,546 +304,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Error fetching HTTPS response\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN service unavailable; reason: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Got inappropriate HTTP CONNECT response: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Got CONNECT response: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "No memory for options\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Unknown CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "No MTU received. Aborting\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "No IP address received. Aborting\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Reconnect gave different Legacy IP address (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Reconnect gave different IPv6 address (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Reconnect gave different IPv6 netmask (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP connected. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Compression setup failed\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Allocation of deflate buffer failed\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "inflate failed\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "deflate failed %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Unexpected packet length. SSL_read returned %d but packet is\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Got CSTP DPD request\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Got CSTP DPD response\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Got CSTP Keepalive\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Received uncompressed data packet of %d bytes\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Received server disconnect: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Compressed packet received in !deflate mode\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "received server terminate packet\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL wrote too few bytes! Asked for %d, sent %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP rekey due\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTP Dead Peer Detection detected dead peer!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Reconnect failed\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Send CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Send CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Sending uncompressed data packet of %d bytes\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Send BYE packet: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Initialise DTLSv1 session failed\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Initialise DTLSv1 CTX failed\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Set DTLS cipher list failed\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Not precisely one DTLS cipher\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Your OpenSSL is older than the one you built against, so DTLS may fail!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS handshake timed out\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS handshake failed: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Failed to set DTLS priority: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Failed to set DTLS session parameters: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Failed to set DTLS MTU: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "DTLS handshake failed: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "No DTLS address\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Server offered no DTLS cipher option\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "No DTLS when connected via proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS option %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Attempt new DTLS connection\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Received DTLS packet 0x%02x of %d bytes\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Got DTLS DPD request\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Failed to send DPD response. Expect disconnect\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Got DTLS DPD response\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Got DTLS Keepalive\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Unknown DTLS packet type %02x, len %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS rekey due\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS Dead Peer Detection detected dead peer!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Send DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Failed to send DPD request. Expect disconnect\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Send DTLS Keepalive\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Failed to send keepalive request. Expect disconnect\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS got write error %d. Falling back to SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS got write error: %s. Falling back to SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgstr ""
+
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -945,6 +879,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Failed to set DTLS priority: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Failed to set DTLS session parameters: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Failed to set DTLS MTU: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS handshake timed out\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "DTLS handshake failed: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -965,7 +990,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -984,7 +1009,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL write cancelled\n"
 
@@ -993,486 +1018,490 @@ msgstr "SSL write cancelled\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Failed to write to SSL socket: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL read cancelled\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Failed to read from SSL socket: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "SSL read error: %s; reconnecting.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "SSL send failed: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Could not extract expiration time of certificate\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Client certificate has expired at"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Client certificate expires soon at"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Failed to load item '%s' from keystore: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Failed to open key/certificate file %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Failed to stat key/certificate file %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Failed to allocate certificate buffer\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Failed to read certificate into memory: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Failed to setup PKCS#12 data structure: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Failed to decrypt PKCS#12 certificate file\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Enter PKCS#12 pass phrase:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Failed to process PKCS#12 file: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Failed to load PKCS#12 certificate: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Importing X509 certificate failed: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Setting PKCS#11 certificate failed: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Could not initialise MD5 hash: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "MD5 hash error: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Missing DEK-Info: header from OpenSSL encrypted key\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Cannot determine PEM encryption type\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Unsupported PEM encryption type: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Invalid salt in encrypted PEM file\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Error base64-decoding encrypted PEM file: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Encrypted PEM file too short\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Failed to initialise cipher for decrypting PEM file: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Failed to decrypt PEM key: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Decrypting PEM key failed\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Enter PEM pass phrase:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "This binary built without PKCS#11 support\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Using PKCS#11 certificate %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Error loading certificate from PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Using certificate file %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "PKCS#11 file contained no certificate\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "No certificate found in file"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Loading certificate failed: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Error initialising private key structure: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Error initialising PKCS#11 key structure: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Error importing PKCS#11 URL %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Using PKCS#11 key %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Error importing PKCS#11 key into private key structure: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Using private key file %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "This version of OpenConnect was built without TPM support\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Failed to interpret PEM file\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Failed to load PKCS#1 private key: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Failed to load private key as PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Failed to decrypt PKCS#8 certificate file\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Failed to determine type of private key %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Enter PKCS#8 pass phrase:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Failed to get key ID: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Error signing test data with private key: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Error validating signature against certificate: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "No SSL certificate found to match private key\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Using client certificate '%s'\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Setting certificate revocation list failed: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Failed to allocate memory for supporting certificates\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Adding supporting CA '%s'\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Setting certificate failed: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Server presented no certificate\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Error initialising X509 cert structure\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Error importing server's cert\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Error checking server cert status\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certificate revoked"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "signer not found"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "signer not a CA certificate"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "insecure algorithm"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certificate not yet activated"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certificate expired"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "signature verification failed"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certificate does not match hostname"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Server certificate verify failed: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Failed to allocate memory for cafile certs\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Failed to read certs from cafile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Failed to open CA file '%s': %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Loading certificate failed. Aborting.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL negotiation with %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL connection cancelled\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL connection failure: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS non-fatal return during handshake: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Connected to HTTPS on %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN required for %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Wrong PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "This is the final try before locking!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Only a few tries left before locking!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Enter PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1666,7 +1695,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1684,235 +1713,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "No memory for allocating cookies\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Failed to parse HTTP response '%s'\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Got HTTP response: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Error processing HTTP response\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ignoring unknown HTTP response line '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Invalid cookie offered: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL certificate authentication failed\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Response body has negative size (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Unknown Transfer-Encoding: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP body %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Error reading HTTP response body\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Error fetching chunk header\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Error fetching HTTP response body\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Error in chunked decoding. Expected '', got: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Cannot receive HTTP 1.0 body without closing connection\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Failed to parse redirected URL '%s': %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Cannot follow redirection to non-https URL '%s'\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Allocating new path for relative redirect failed: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Unexpected %d result from server\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "request granted"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "general failure"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "connection not allowed by ruleset"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "network unreachable"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "host unreachable"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "connection refused by destination host"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL expired"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "command not supported / protocol error"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "address type not supported"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Error writing auth request to SOCKS proxy: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Error reading auth response from SOCKS proxy: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Requesting SOCKS proxy connection to %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Error writing connect request to SOCKS proxy: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Error reading connect response from SOCKS proxy: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS proxy error %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS proxy error %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Unexpected address type %02x in SOCKS connect response\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Requesting HTTP proxy connection to %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Sending proxy request failed: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Unknown proxy type '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Only http or socks(5) proxies supported\n"
 
@@ -1925,70 +1954,83 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Built against SSL library with no Cisco DTLS support\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Failed to parse server URL '%s'\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Only https:// permitted for server URL\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "No form handler; cannot authenticate.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Allocation failure for string from stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Using OpenSSL. Features present:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Using GnuTLS. Features present:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL ENGINE not present"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "using OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -1997,31 +2039,31 @@ msgstr ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Usage:  openconnect [options] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2030,306 +2072,306 @@ msgstr ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Read options from config file"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Continue in background after startup"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Write the daemon's PID to this file"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Use SSL client certificate CERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Warn when certificate lifetime < DAYS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Use SSL private key file KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Use WebVPN cookie COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Read cookie from standard input"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Enable compression (default)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Disable compression"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Set minimum Dead Peer Detection interval"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Set login usergroup"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Display help text"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Use IFNAME for tunnel interface"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Use syslog for progress messages"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Drop privileges after connecting"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Drop privileges during CSD execution"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Run SCRIPT instead of CSD binary"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indicate path MTU to/from server"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Set key passphrase or TPM SRK PIN"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Key passphrase is fsid of file system"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Set proxy server"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Disable proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Use libproxy to automatically configure proxy"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTE: libproxy disabled in this build)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Less output"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Set packet queue limit to LEN pkts"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "Shell command line for using a vpnc-compatible config script"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "default"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Pass traffic to 'script' program, not tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Set login username"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Report version number"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "More output"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML config file"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Choose authentication login selection"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Authenticate only and print login info"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Fetch webvpn cookie only; don't connect"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Print webvpn cookie before connecting"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Cert file for server verification"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Do not ask for IPv6 connectivity"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "OpenSSL ciphers to support for DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Disable DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Disable HTTP connection re-use"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Disable password/SecurID authentication"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Do not require server SSL cert to be valid"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Do not expect user input; exit if it is required"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Read password from standard input"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Connection retry timeout in seconds"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Server's certificate SHA1 fingerprint"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP header User-Agent: field"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Set local port for DTLS datagrams"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Failed to get line from config file: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Unrecognised option at line %d: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Option '%s' does not take an argument at line %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Option '%s' requires an argument at line %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2337,49 +2379,49 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Failed to allocate vpninfo structure\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Cannot use 'config' option inside config file\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Cannot open config file '%s': %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d too small\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2388,124 +2430,131 @@ msgstr ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Queue length zero not permitted; using 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect version %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Too many arguments on command line\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "No server specified\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "This version of openconnect was built without libproxy support\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Failed to obtain WebVPN cookie\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Creating SSL connection failed\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Set up DTLS failed; using SSL instead\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr "No --script argument provided; DNS and routing are not configured\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Failed to open '%s' for write: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Continuing in background; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Failed to open %s for write: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Failed to write config to %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Server SSL certificate didn't match: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2516,89 +2565,100 @@ msgstr ""
 "Certificate from VPN server \"%s\" failed verification.\n"
 "Reason: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr "Enter '%s' to accept, '%s' to abort; anything else to view: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "no"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "yes"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Auth choice \"%s\" not available\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "User input required in non-interactive mode\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2613,16 +2673,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr "Set up tun device failed\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "No work to do; sleeping for %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2688,7 +2748,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2820,501 +2880,615 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Initialise DTLSv1 session failed\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Initialise DTLSv1 CTX failed\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Set DTLS cipher list failed\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Not precisely one DTLS cipher\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Your OpenSSL is older than the one you built against, so DTLS may fail!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS handshake failed: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Failed to write to SSL socket\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Failed to read from SSL socket\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr "SSL read error %d (server probably closed connection); reconnecting.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write failed: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM password too long (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Extra cert from %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Parse PKCS#12 failed (see above errors)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 contained no certificate!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 contained no private key!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Can't load TPM engine.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Failed to init TPM engine\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Failed to set TPM SRK password\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Failed to load TPM private key\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Add key from TPM failed\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Failed to open certificate file %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Loading certificate failed\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Failed to create BIO for keystore item '%s'\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Loading private key failed (wrong passphrase?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Loading private key failed (see above errors)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Failed to load X509 certificate from keystore\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Failed to use X509 certificate from keystore\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Failed to use private key from keystore\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Failed to open private key file %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Failed to identify private key type in '%s'\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Matched DNS altname '%s'\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "No match for altname '%s'\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Certificate has GEN_IPADD altname with bogus length %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Matched %s address '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "No match for %s address '%s'\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' has non-empty path; ignoring\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Matched URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "No match for URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "No altname in peer cert matched '%s'\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "No subject name in peer cert!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Failed to parse subject name in peer cert\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Peer cert subject mismatch ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Matched peer certificate subject name '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Extra cert from cafile: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Error in client cert notAfter field\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Failed to read certs from CA file '%s'\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Failed to open CA file '%s'\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL connection failure\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Discard bad split include: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Discard bad split exclude: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Failed to spawn script '%s' for %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Script '%s' exited abnormally (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Script '%s' returned error %d\n"
@@ -3611,83 +3785,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/en_US.po b/po/en_US.po
index 89fe1954..45e16a84 100644
--- a/po/en_US.po
+++ b/po/en_US.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-11-15 08:31+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: English (United States) (http://www.transifex.com/projects/p/"
@@ -172,7 +172,7 @@ msgstr "Asked for password but '--no-passwd' set\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Failed to open HTTPS connection to %s\n"
@@ -304,546 +304,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Error fetching HTTPS response\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN service unavailable; reason: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Got inappropriate HTTP CONNECT response: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Got CONNECT response: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "No memory for options\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Unknown CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "No IP address received. Aborting\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Reconnect gave different Legacy IP address (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Reconnect gave different IPv6 address (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Reconnect gave different IPv6 netmask (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP connected. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Compression setup failed\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Allocation of deflate buffer failed\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "inflate failed\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "deflate failed %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Unexpected packet length. SSL_read returned %d but packet is\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Got CSTP DPD request\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Got CSTP DPD response\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Got CSTP Keepalive\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Received uncompressed data packet of %d bytes\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Received server disconnect: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Compressed packet received in !deflate mode\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "received server terminate packet\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL wrote too few bytes! Asked for %d, sent %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP rekey due\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTP Dead Peer Detection detected dead peer!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Reconnect failed\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Send CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Send CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Sending uncompressed data packet of %d bytes\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Send BYE packet: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Initialize DTLSv1 session failed\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Initialize DTLSv1 CTX failed\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Set DTLS cipher list failed\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Not precisely one DTLS cipher\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Your OpenSSL is older than the one you built against, so DTLS may fail!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS handshake timed out\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS handshake failed: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "No DTLS address\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Server offered no DTLS cipher option\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "No DTLS when connected via proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS option %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Attempt new DTLS connection\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Received DTLS packet 0x%02x of %d bytes\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Got DTLS DPD request\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Failed to send DPD response. Expect disconnect\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Got DTLS DPD response\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Got DTLS Keepalive\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Unknown DTLS packet type %02x, len %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS rekey due\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS Dead Peer Detection detected dead peer!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Send DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Send DTLS Keepalive\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS got write error %d. Falling back to SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
-msgstr "SSL operation canceled\n"
-
-#: dtls.c:1169
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:531
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
+msgstr ""
+
+#: dtls.c:544
+#, c-format
+msgid "Failed to send DPD request (%d %d)\n"
+msgstr ""
+
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Timeout while waiting for DPD response; trying %d\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
+
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -945,6 +879,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS handshake timed out\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -965,7 +990,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -984,7 +1009,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL write canceled\n"
 
@@ -993,485 +1018,489 @@ msgstr "SSL write canceled\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL read canceled\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Client certificate has expired at"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Client certificate expires soon at"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Using certificate file %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "This version of OpenConnect was built without TPM support\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certificate does not match hostname"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Server certificate verify failed: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Loading certificate failed. Aborting.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL negotiation with %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL connection canceled\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Connected to HTTPS on %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1665,7 +1694,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1683,235 +1712,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "No memory for allocating cookies\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Failed to parse HTTP response '%s'\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Got HTTP response: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Error processing HTTP response\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ignoring unknown HTTP response line '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Invalid cookie offered: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL certificate authentication failed\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Response body has negative size (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Unknown Transfer-Encoding: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP body %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Error reading HTTP response body\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Error fetching chunk header\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Error fetching HTTP response body\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Error in chunked decoding. Expected '', got: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Cannot receive HTTP 1.0 body without closing connection\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Failed to parse redirected URL '%s': %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Allocating new path for relative redirect failed: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Unexpected %d result from server\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "request granted"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "general failure"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "connection not allowed by ruleset"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "network unreachable"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "host unreachable"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "connection refused by destination host"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL expired"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "command not supported / protocol error"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "address type not supported"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Error writing auth request to SOCKS proxy: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Error reading auth response from SOCKS proxy: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Requesting SOCKS proxy connection to %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Error writing connect request to SOCKS proxy: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Error reading connect response from SOCKS proxy: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS proxy error %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS proxy error %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Unexpected address type %02x in SOCKS connect response\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Requesting HTTP proxy connection to %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Sending proxy request failed: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Unknown proxy type '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Only http or socks(5) proxies supported\n"
 
@@ -1924,45 +1953,62 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Failed to parse server URL '%s'\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Only https:// permitted for server URL\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Allocation failure for string from stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1971,56 +2017,52 @@ msgstr ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Usage:  openconnect [options] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2029,306 +2071,306 @@ msgstr ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Continue in background after startup"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Write the daemon's PID to this file"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Use SSL client certificate CERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Warn when certificate lifetime < DAYS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Use SSL private key file KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Use WebVPN cookie COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Read cookie from standard input"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Enable compression (default)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Disable compression"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Set minimum Dead Peer Detection interval"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Set login usergroup"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Display help text"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Use IFNAME for tunnel interface"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Use syslog for progress messages"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Drop privileges after connecting"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Drop privileges during CSD execution"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Run SCRIPT instead of CSD binary"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Set key passphrase or TPM SRK PIN"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Key passphrase is fsid of file system"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Set proxy server"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Disable proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Use libproxy to automatically configure proxy"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTE: libproxy disabled in this build)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Less output"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Set packet queue limit to LEN pkts"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "Shell command line for using a vpnc-compatible config script"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Pass traffic to 'script' program, not tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Set login username"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Report version number"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "More output"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML config file"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Choose authentication login selection"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Fetch webvpn cookie only; don't connect"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Print webvpn cookie before connecting"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Cert file for server verification"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Do not ask for IPv6 connectivity"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "OpenSSL ciphers to support for DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Disable DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Disable HTTP connection re-use"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Disable password/SecurID authentication"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Do not require server SSL cert to be valid"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Do not expect user input; exit if it is required"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Read password from standard input"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Connection retry timeout in seconds"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Server's certificate SHA1 fingerprint"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP header User-Agent: field"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2336,7 +2378,7 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2345,42 +2387,42 @@ msgstr ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Failed to allocate vpninfo structure\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d too small\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2389,124 +2431,131 @@ msgstr ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Queue length zero not permitted; using 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect version %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "No server specified\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "This version of openconnect was built without libproxy support\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Failed to obtain WebVPN cookie\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Creating SSL connection failed\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Set up DTLS failed; using SSL instead\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr "No --script argument provided; DNS and routing are not configured\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Failed to open '%s' for write: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Continuing in background; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "User canceled (SIGINT); exiting;\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Failed to open %s for write: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Failed to write config to %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Server SSL certificate didn't match: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2517,89 +2566,100 @@ msgstr ""
 "Certificate from VPN server \"%s\" failed verification.\n"
 "Reason: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "no"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "yes"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Auth choice \"%s\" not available\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2614,16 +2674,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr "Set up tun device failed\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "No work to do; sleeping for %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2689,7 +2749,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2821,501 +2881,615 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Initialize DTLSv1 session failed\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Initialize DTLSv1 CTX failed\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Set DTLS cipher list failed\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Not precisely one DTLS cipher\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Your OpenSSL is older than the one you built against, so DTLS may fail!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS handshake failed: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr "SSL read error %d (server probably closed connection); reconnecting.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write failed: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Extra cert from %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Parse PKCS#12 failed (see above errors)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 contained no certificate!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 contained no private key!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Can't load TPM engine.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Failed to init TPM engine\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Failed to set TPM SRK password\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Failed to load TPM private key\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Add key from TPM failed\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Failed to open certificate file %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Loading certificate failed\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Loading private key failed (wrong passphrase?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Loading private key failed (see above errors)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Failed to open private key file %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Failed to identify private key type in '%s'\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Matched DNS altname '%s'\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "No match for altname '%s'\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Certificate has GEN_IPADD altname with bogus length %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Matched %s address '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "No match for %s address '%s'\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' has non-empty path; ignoring\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Matched URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "No match for URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "No altname in peer cert matched '%s'\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "No subject name in peer cert!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Failed to parse subject name in peer cert\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Peer cert subject mismatch ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Matched peer certificate subject name '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Extra cert from cafile: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Error in client cert notAfter field\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Failed to open CA file '%s'\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL connection failure\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Discard bad split include: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Discard bad split exclude: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Failed to spawn script '%s' for %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3612,83 +3786,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/eo.po b/po/eo.po
index c80001f9..823dc8f4 100644
--- a/po/eo.po
+++ b/po/eo.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Esperanto (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/es.po b/po/es.po
index 11584372..de84648f 100644
--- a/po/es.po
+++ b/po/es.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Spanish (Castilian) (http://www.transifex.net/projects/p/"
 "meego/language/es/)\n"
@@ -175,7 +175,7 @@ msgstr "Se pidió la contraseña, pero se estableció '--no-passwd'\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "No se descarga el perfil XML porque ya SHA1 ya coincide\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Falló al abrir una conexión HTTPS con %s\n"
@@ -317,562 +317,492 @@ msgstr "(¡Error al describir el error!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "Error: no se pueden inicializar los sockets\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "Error crítico: el secreto DTLS maestro no está inicializado. Informe de "
 "esto.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Error al crear la solicitud HTTPS CONNECT\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Error al obtener respuesta HTTPS\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Servicio VPN no disponible; razón: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Se obtuvo una respuesta HTTP CONNECT inadecuada: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Se obtuvo la respuesta CONNECT: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "No hay memoria para opciones\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<omitido>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session no es de 64 caracteres; es: «%s»\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "DTLS-Content-Encoding %s desconocido\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "CSTP-Content-Encoding %s desconocido\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "No se recibió MTU. Abortando\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "No se recibió dirección IP. Abortando\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Configuración de IPv6 recibida pero la MTU %d es demasiado pequeña.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "La reconexión dio una dirección IP heredada distinta (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "La reconexión dio una máscara de red heredada distinta (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "La reconexión dio una dirección IPv6 heredada distinta (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 "La reconexión dio una máscara de red IPv6 heredada distinta (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP conectado. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "Conjunto de cifrado CSTP: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Falló la configuración de compresión\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Falló la localización del buffer vacío\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "falló el llenado\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Fallo de la descompresión LZS: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Falló la descompresión LZ4\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Tipo de compresión %d desconocido\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Paquete de datos comprimidos %s de %d bytes recibido (eran %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "falló el vaciado %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Falló la reserva\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Paquete corto recibido (%d bytes)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 "Longitud de paquete inesperada. SSL_read devolvió %d pero el paquete es\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Se obtuvo la petición CSTP DPD\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Se obtuvo la respuesta CSTP DPD\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Se obtuvo Keppalive CSTP\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Se recibió el paquete de datos sin comprimir de %d bytes\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Se recibió el una desconexión del servidor: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Recibida una desconexión del servidor\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Se recibió el paquete comprimido en modo !vacío\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "se recibió el paquete de fin del servidor\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Paquete desconocido %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL escribió demasiados pocos bytes. Se pidieron %d, se enviaron %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Renegociación de clave CSTP pendiente\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Renegociación fallida; intentando un túnel nuevo\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "La detección de muerte del par CSTP detectó la muerte del par\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Falló al reconectar\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Enviar CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Enviar CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Enviando paquete de datos comprimidos de %d bytes (eran %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Enviando paquete de datos sin comprimir de %d bytes\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Enviar paquete BYE: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Intentando la autenticación Digest en el proxy\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Intentando la autenticación Digest al servidor «%s»\n"
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr "Falló al crear SSL_SESSION ASN.1 para OpenSSL: %s\n"
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr "OpenSSL falló al analizar SSL_SESSION ASN.1\n"
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Falló al inicializar la sesión DTLSv1\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Falló al inicializar DTLSv1 CTX\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Falló al establecer la lista de cifrado DTLS\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "No precisamente un cifrado DTLS\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() falló con el protocolo antiguo 0x%x\n"
-"¿Está usando una versión de OpenSSL más antigua que la 0.9.8m?\n"
-"Consulte http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use la opción de la línea de comandos --no-dtls para evitar este mensaje\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "Establecida la conexíon DTLS (usando OpenSSL). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr "Compresión de la conexión DTLS utilizando %s.\n"
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Su versión de OpenSSL es anterior a la que usó para compilar, por lo que "
-"DTLS podría fallar."
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "Expiró tiempo de la negociación DTLS\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Esto es probablemente debido a que su OpenSSL está roto\n"
-"Consulte http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "Falló la negociación DTLS: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-"Parámetros DTLS desconocidos para la petición del conjunto de cifrado «%s»\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Falló al establecer la prioridad DTLS: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Falló al establecer los parámetros de sesión: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Falló al establecer la MTU de DTLS %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Conexión DTLS establecida (usando GnuTLS). Ciphersuite %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Falló la negociación DTLS: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(¿Es un cortafuegos lo que impide el envío de paquetes UDP?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "Intento de conexión DTLS con un «fd» existente\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Sin dirección DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "El servidor no ofreció opción de cifrado DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Sin DTLS cuando se conecta vía proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Opción DTLS %s: %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS inicializado. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Intentar nueva conexión DTLS\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Recibió el paquete DTLS 0x%02x de %d bytes\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Solicitud DTLS DPD obtenida\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Falló al enviar respuesta DPD. Espere desconectar\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Respuesta DTLS DPD obtenida\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Obtenido Keepalive DTLS\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 "Paquete DTLS comprimido recibido cuando la compresión no estaba activada\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Paquete DTLS tipo %02x desconocido, longitud %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Renegociación de clave DTLS pendiente\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Falló la renegociación DTLS; reconectando\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "¡La detección de muerte del par DTLS detectó la muerte del par!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Enviar DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Falló al enviar petición DPD. Espere para desconectar\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Enviar Keepalive DTLS\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Falló al enviar petición de keepalive. Espere para desconectar\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Se recibió un paquete desconocido (len %d): %02x %02x %02x %02x…\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS obtuvo el error de escritura %d. Volviendo a SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS obtuvo el error de escritura: %s. Volviendo a SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Envió paquete DTLS de %d bytes; el envío DTLS devolvió %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
-msgstr "Operación SSL cancelada\n"
-
-#: dtls.c:1169
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Iniciando la detección de IPv4 MTU (min=%d, max=%d)\n"
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
-msgstr "Demasiado tiempo en detectar el bucle MTU; liberando.\n"
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:531
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
-msgstr "Falló al enviar la solicitud DPD (%d): %s\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
+msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
+msgstr ""
+
+#: dtls.c:544
+#, c-format
+msgid "Failed to send DPD request (%d %d)\n"
+msgstr ""
+
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 "Paquete inesperado recibido (%.2x) en la detección de MTU; omitiendo.\n"
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
-msgstr "Falló al recibir la solicitud DPD (%d): %s\n"
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
+
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Iniciando detección de MTU IPv6\n"
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "Detectado MTU de %d bytes (eran %d)\n"
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "No hay cambios en MTU después de la detección (fue %d)\n"
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr "Aceptando paquete ESP esperado con la secuencia %u\n"
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
-"Descartando paquete ESP antiguo con la secuencia %u (se esperaba %<PRIu64>)\n"
+"Aceptando paquete ESP después de lo esperado con la secuencia %u (se "
+"esperaba %<PRIu64>)\n"
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
-"Aceptando paquete ESP fuera de orden con la secuencia %u (se esperaba "
-"%<PRIu64>)\n"
+"Descartando paquete ESP antiguo con la secuencia %u (se esperaba %<PRIu64>)\n"
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr "Descartando paquete ESP repetido con la secuencia %u\n"
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
-"Aceptando paquete ESP después de lo esperado con la secuencia %u (se "
-"esperaba %<PRIu64>)\n"
+"Aceptando paquete ESP fuera de orden con la secuencia %u (se esperaba "
+"%<PRIu64>)\n"
 
 #: esp.c:68
 #, c-format
@@ -975,6 +905,98 @@ msgstr "Falló al enviar el paquete ESP: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Enviando paquete ESP de %d bytes\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+"Parámetros DTLS desconocidos para la petición del conjunto de cifrado «%s»\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Falló al establecer la prioridad DTLS: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Falló al establecer los parámetros de sesión: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Falló al establecer la MTU de DTLS %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Conexión DTLS establecida (usando GnuTLS). Ciphersuite %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr "Compresión de la conexión DTLS utilizando %s.\n"
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "Expiró tiempo de la negociación DTLS\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Falló la negociación DTLS: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(¿Es un cortafuegos lo que impide el envío de paquetes UDP?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -995,7 +1017,7 @@ msgstr "Falló al generar las claves aleatorias para ESP: %s\n"
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr "Falló al calcular HMAC para el paquete ESP: %s\n"
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr "Paquete ESP recibido con HMAC no válida\n"
 
@@ -1014,7 +1036,7 @@ msgstr "Falló al generar el VI del paquete ESP: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Falló al cifrar el paquete ESP: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Escritura SSL cancelada\n"
 
@@ -1023,494 +1045,498 @@ msgstr "Escritura SSL cancelada\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Falló al escribir en el socket SSL: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Lectura SSL cancelada\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "Socket SSL cerrado no limpiamente\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Falló al leer del socket SSL: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Error de lectura SSL: %s; reconectando.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "Falló el envío SSL: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "No se pudo extraer la fecha de caducidad del certificado\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "El certificado del cliente ha caducado el"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "El certificado del cliente caduca pronto el"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Falló al cargar el elemento «%s» del almacén de claves: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Falló al abrir el archivo de clave/certificado %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Falló al obtener el estado del archivo de clave/certificado %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Falló al asignar el búfer del certificado\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Falló al leer el certificado en memoria: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Falló al configurar la estructura de datos PKCS#12: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Falló al descifrar el archivo del certificado PKCS#12\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Introduzca contraseña PKCS#12:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Falló al procesar el archivo PKCS#12: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Falló al cargar el certificado PKCS#12: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Falló la importación del certificado X509: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Falló la configuración del certificado PKCS#11: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "No se pudo inicializar el hash MD5: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "Error del hash MD5: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "DEK-Info perdido: cabecera desde clave OpenSSL cifrada\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "No se puede determinar el tipo de cifrado PEM\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Tipo de cifrado PEM no soportado: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Semilla no válida en el archivo PEM cifrado\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Error base64-decoding del archivo PEM cifrado: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Archivo cifrado PEM demasiado corto\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 "Falló al inicializar el cifrado para el archivo PEM de descifrado: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Falló al descrifrar la clave PEM: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Falló al descifrar la clave PEM\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Introduzca contraseña PEM:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Este binario se compiló sin soporte para sistema de claves\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Este binario se compiló sin soporte PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Usando certificado PKCS#11 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "Usando el certificado del sistema %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Error al cargar el certificado desde PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Error al cargar el certificado del sistema: %s\n"
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Usando archivo de certificado %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "El archivo PKCS#11 no contiene ningún certificado\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Certificado no encontrado en el archivo"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Falló al cargar certificado: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "Usando la clave del sistema %s\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Error al inicializar la estructura de clave privada: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Error al importar la clave del sistema %s: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "Probando URL de clave PKCS#11 %s\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Error al inicializar la estructura de clave PKCS#11: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Error al importar el URL PKCS#11 %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Usando clave PKCS#11 %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 "Error al importar la clave PKCS#11 a la estructura de clave privada: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Usando archivo de clave privada: %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Esta versión de OpenConnect se compiló sin soporte TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Falló al traducir el archivo PEM\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Falló al cargar la clave privada PKCS#1: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Falló al cargar la clave privada como PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Falló al descifrar el archivo del certificado PKCS#8\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Falló al determinar el tipo de clave privada %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Introduzca contraseña PKCS#8:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Falló al obtener el ID de la clave: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Error al firmar el test de datos con la clave privada: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Error al validar la firma con el certificado: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 "No se encontró ningún certificado SSL que coincida con la clave privada\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Usando el certificado del cliente '%s'\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Configuración de lista de revocación del certificado fallida: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Falló al asignar memoria para el certificado\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "AVISO: GnuTLS devolvió un distribuidor de certificados incorrecto; puede que "
 "falle la autenticación\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "Se obtuvo el siguiente CA «%s» de PKCS11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Falló al asignar memoria para soportar certificados\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Añadiendo soporte CA '%s'\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Falló al configurar el certificado: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "El servidor no presentó ningún certificado\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 "Error al comparar el certificado del servidor en la renegociación: %s\n"
 "\n"
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 "El servidor ha presentado un certificado diferente en la renegociación\n"
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 "El servidor ha presentado un certificado idéntico en la renegociación\n"
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Error al inicializar la estructura de certificado X509\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Error al importar el certificado del servidor\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "No se pudo calcular hash del certificado del servidor\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Error al comprobar el estado del certificado del servidor\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certificado revocado"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "firmante no encontrado"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "el firmante no es un certificado CA"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "algoritmo inseguro"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certificado no activado todavía"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certificado caducado"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "verificación de la firma fallida"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "el certificado no coincide con el nombre del servidor"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "La verificación del certificado del servidor falló: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Falló al asignar memoria para certificados cafile\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Falló al leer certificados desde cafile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Falló al abrir el archivo CA '%s': %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Carga de certificado fallida. Abortando.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Falló al establecer la cadena de prioridad TLS («%s»): %s\n"
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Negociación SSL con «%s»\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Conexión SSL cancelada\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Fallo de la conexión TLS: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Retorno no fatal de GnuTLS durante la negociación: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Conectó a HTTPS en %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Renegociar SSL en %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN requerido por %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "PIN incorrecto"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "¡Éste es el último intento antes de bloquear!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "¡Sólo quedan unos pocos intentos antes de bloquear!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Introducir PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Algoritmo OATH HMAC no soportado\n"
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Falló al calcular OATH HMAC: %s\n"
@@ -1707,7 +1733,7 @@ msgstr "Intentando la autenticación HTTP Bacis en el proxy\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Intentando la autenticación HTTP básica en el servidor «%s»\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Esta versión de OpenConnect se compiló sin soporte GSSAPI\n"
 
@@ -1729,242 +1755,242 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "No hay más métodos de autenticación que usar\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Sin memoria para asignar cookies\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Falló al analizar la respuesta HTTP '%s'\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Se obtuvo la respuesta HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Error al procesar la respuesta HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ignorando línea no reconocida de la respuesta HTTP '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Cookie ofrecida no válida: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Falló la autenticación del certificado SSL\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "El cuerpo de la respuesta tiene un tamaño negativo (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Codificación de transferencia desconocida: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "Cuerpo HTTP %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Error leyendo el cuerpo de la respuesta HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Error recuperando el fragmento de la cabecera\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Error recuperando el cuerpo de la respuesta HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 "Error en el fragmentado de la decodificación. Se esperaba '', se obtuvo: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "No se pudo recibir el cuerpo HTTP 1.0 sin cerrar la conexión\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Falló al analizar el URL redirigido '%s': %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "No se pudo seguir el redireccionamiento al URL no https '%s'\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 "Asignando una nueva ruta para el redireccionamiento relativo fallido: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Resultado %d del servidor inesperado\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "petición concedida"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "fallo general"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "conexión no permitida por el conjunto de reglas"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "red inaccesible"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "servidor inaccesible"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "conexión rechazada por el servidor de destino"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL caducado"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "comando no soportado / error de protocolo"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "tipo de dirección no soportada"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "El servidor SOCKS requiere un nombre de usuario y una contraseña, pero no "
 "hay ninguno\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "El nombre de usuario y la contraseña para la autenticación SOCKS deben ser < "
 "255 bytes\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Error al escribir petición auth al proxy SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Error al leer respuesta auth desde el proxy SOCKS: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Respuesta auth inesperada desde el proxy SOCKS: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Autenticado en el servidor SOCKS usando una contraseña\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Falló la autenticación con contraseña en el servidor SOCKS\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "El servidor SOCKS ha solicitado autenticación GSSAPI\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "El servidor SOCKS solicita autenticación por contraseña\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "El servidor SOCKS requiere autenticación\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 "El servidor SOCKS ha solicitado una autenticación de tipo %02x desconocida\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Solicitando conexión al proxy SOCKS a %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Error al escribir la petición de conectar al proxy SOCKS: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Error al leer la respuesta de conexión desde el proxy SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Respuesta de conexión inesperada desde el proxy SOCKS: %02x %02x…\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Error del proxy SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Error del proxy SOCKS %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Tipo de dirección inesperado %02x en la respuesta de conexión SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Solicitando conexión HTTP proxy a %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Falló al enviar petición de proxy: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Falló la petición CONNECT del proxy: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Tipo de proxy desconocido '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Sólo se soportan proxies HTTP o socks(5)\n"
 
@@ -1977,45 +2003,62 @@ msgstr "Protocolo VPN '%s' desconocido\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Compilado con la biblioteca SSL sin soporte para Cisco DTLS\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Falló al analizar el URL del servidor '%s'\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Sólo se permite https:// para el URL del servidor\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "No hay gestor de formulario; no se puede autenticar.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr "Falló CommandLineToArgvW(): %s\n"
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr "Error fatal al gestionar la línea de comandos\n"
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() ha fallado: %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Error al convertir la entrada de la consola: %s\n"
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Falló la ubicación para la cadena desde stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -2024,25 +2067,21 @@ msgstr ""
 "Para obtener ayuda de OpenConnect, consulte la página web\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Usando OpenSSL. Características disponibles:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Usando GnuTLS. Características disponibles:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "Motor OpenSSL no disponible"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "usando OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2052,31 +2091,31 @@ msgstr ""
 "Advertencia: sin soporte DTLS en este binario. El rendimiento se verá "
 "afectado.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "No se puede procesar esta ruta ejecutable «%s»"
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Falló la ubicación de la ruta de vpnc-script\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Cambiar nombre de servidor «%s» a «%s»\n"
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Uso:  openconnect [opciones] <servidor>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2085,310 +2124,310 @@ msgstr ""
 "Cliente abierto de Cisco VPN AnyConnect, versión %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Leer opciones del archivo de configuración"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Continuar en segundo plano tras el arranque"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Escribir los PID de los demonios en este archivo"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Usar certificado CERT del cliente SSL"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Avisar cuando el tiempo de vida del certificado sea menor que DAYS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Usar archivo KEY de clave SSL privada"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Usar cookie COOKIE de WebVPN"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Leer cookie de la entrada estándar"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Activar compresión (predeterminado)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Desactivar compresión"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Establecer el intervalo mínimo de detección de par muerto"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Establecer grupo de usuario de login"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Mostrar el texto de ayuda"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Usar IFNAME para la interfaz del túnel"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Usar registros de sucesos del sistema para mensajes de progreso"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Añadir marca de tiempo a los mensajes de progreso"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Revocar privilegios después de conectar"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Revocar privilegios durante la ejecución CSD"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Ejecutar SCRIPT en lugar de binario CSD"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indicar ruta MTU al/desde el servidor"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Establecer clave de frase de paso o pin TPM SRK"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "La clave de frase de paso es un fsid de un sistema de archivos"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Establecer servidor proxy"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Establecer los métodos de autenticación del proxy"
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Desactivar proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Usar libproxy para configurar automáticamente el proxy"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTA: libproxy está desactivado en esta versión)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Solicitar la perfecta confidencialidad del envío"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Menos salida"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Establecer límite de cola de paquete a LEN pqts"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Terminal de línea de comandos para usar un script de configuración "
 "compatible con vpnc"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "predeterminado"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Pasar el tráfico al «script», no al dispositivo TUN"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Establecer nombre de usuario de inicio de sesión"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Informe del número de versión"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Más salida"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Volcado del tráfico de autenticación HTTP (implica --verbose"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Archivo XML de configuración"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Elegir autenticación de selección de inicio de sesión"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Sólo autenticar y mostrar información del inicio de sesión"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Sólo obtener la cookie webvpn; no conectar"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Mostrar la cookie de la webvpn antes de conectar"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Archivo del certificado para la verificación del servidor"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "No pedir conectividad IPv6"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Claves OpenSSL que soportar por DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Desactivar DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Desactivar reutilización de conexión HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Desactivar autenticación por contraseña/SecurID"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "No se requiere certificado SSL del servidor para ser válido"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 "Desactivar de manera predeterminada las autoridades de certificación del "
 "sistema"
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "No intentar autenticación XML POST"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "No se espera entrada del usuario; sale si lo requiere"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Leer contraseña de la entrada estándar"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Tipo de testigo software: RSA, TOTP o HOTP"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Testigo software secreto"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(Nota: libstoken (RSA SecurID) está desactivado en esta versión)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(NOTA: Yubikey está desactivado en esta versión)"
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Tiempo en segundos para reintento de conexión"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "SHA1 de la huella del servidor de certificados"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Cabecera HTTP User_Agent: campo"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Nombre del servidor local para anunciar al servidor"
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Usar IP cuando al conectar a HOST"
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Tipo de SO (linux, linux-64, win...) que informar"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Establecer puerto local para datagramas DTLS"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Falló al asignar la cadena\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Falló al obtener la línea del archivo de configuración: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Opción no reconocida en la línea %d: «%s»\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "La opción «%s» no coge un argumento en la línea %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "La opción «%s» requiere un argumento en la línea %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Usuario «%s» no válido: %s\n"
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "ID «%d» de usuario no válido: %s\n"
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2400,7 +2439,7 @@ msgstr ""
 "             caracteres «%s» heredado. Puede darse un comportamiento "
 "extraño\n"
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2409,43 +2448,43 @@ msgstr ""
 "ADVERTENCIA: esta versión de openconnect es %s pero\n"
 "             la biblioteca libopenconnect es %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Falló al ubicar la estructura vpninfo\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 "No se puede usar la opción «config» dentro del archivo de configuración\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "No se puede abrir el archivo de configuración «%s»: %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Modo de compresión «%s» no válido\n"
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Faltan los dos puntos en la opción de resolución\n"
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Falló al reservar memoria\n"
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d demasiado pequeña\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2456,126 +2495,133 @@ msgstr ""
 "Si esto ayuda, por favor informe en <openconnect-devel@lists.infradead."
 "org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "No se permite la longitud de cola cero; usando 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect versión %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Modo de testigo software no válido: «%s»\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Credencial de SO «%s» no válida\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Demasiados argumentos en la línea de comandos\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "No se ha especificado ningún servidor\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Esta versión de openconnect se compiló sin soporte para libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Error al abrir la tubería cmd\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Falló al obtener la cookie WebVPN\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Falló al crear la conexión SSL\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Falló al configurar DTLS; se usa SSL en su lugar\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Conectado como %s%s%s, usando %s%s\n"
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "No se proporcionó el argumento --script; No están configurados los DNS ni "
 "las rutas\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Consulte http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Falló al abrir «%s» para escritura: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Se continúa en segundo plano; PID %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "El usuario ha solicitado la reconexión\n"
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Se ha rechazado la cookie al volver a conectar; saliendo.\n"
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Sesión terminada por el servidor; saliendo.\n"
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Cancelado por el usuario (SIGINT); saliendo.\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "El usuario se ha desacoplado de la sesión (SIGHUP); saliendo.\n"
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Error desconocido; saliendo.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Falló al abrir %s para escritura: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Falló al guardar configuración en %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "El certificado del servidor SSL no coincide: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2586,91 +2632,102 @@ msgstr ""
 "Falló la verificación del certificado del servidor VPN «%s».\n"
 "Razón: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Introduzca «%s» para aceptar, «%s» para cancelar; cualquier otra cosa para "
 "ver:"
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "no"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "sí"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Servidor de clave hash: %s\n"
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "La elección de autenticación «%s» coincide con varias opciones\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Elección de autenticación «%s» no disponible\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Entrada del usuario requerida en modo no-interactivo\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Falló al abrir el archivo del testigo para escritura: %s\n"
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Falló al escribir el testigo: %s\n"
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "La cadena de testigo débil no es válida\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "No se puede abrir el archivo ~/.stokenrc\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect no se compiló con soporte para libstoken\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Fallo general en libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect no se compiló con soporte para liboath\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Fallo general en liboath\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Testigo Yubkey no encontrado\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "OpenConnect no se compiló con soporte para Yubikey\n"
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Fallo general de Yubikey: %s\n"
@@ -2685,16 +2742,16 @@ msgstr "Falló al configurar el script TUN\n"
 msgid "Set up tun device failed\n"
 msgstr "Falló al configurar el dispositivo TUN\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "El origen ha pausado la conexión\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Sin trabajo que hacer; durmiendo durante %d ms…\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "Falló WaitForMultipleObjects: %s\n"
@@ -2764,7 +2821,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "Generando código de testigo OATH TOTP\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Generando código de testigo OATH HOTP\n"
 
@@ -2896,511 +2953,628 @@ msgstr "Mensaje KMP  %d conseguido de tamaño %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "TLV no ESP recibidos (grupo %d) en la negociación ESP KMP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Error al crear la solicitud de negociación oNCP\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Escritura corta en la negociación oNCP\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Leer %d bytes del registro SSL\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 "Respuesta inesperada de tamaño %d después del paquete de nombre de host\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 "La respuesta del servidor al paquete de nombre de host es el error 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Paquete no válido a la espera de KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Se esperaba mensaje KMP 301 del servidor pero se obtuvo %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "Mensaje 301 de KMP del servidor demasiado largo (%d bytes)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Se obtuvo un mensaje KMP 301 de longitud %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Falló al leer la longitud de la continuación del registro\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "El registro de %d bytes adicionales es demasiado grande; harían %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Falló al leer la longitud %d de la continuación del registro\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Leídos %d bytes adicionales del mensaje KMP 301\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Error al negociar las claves ESP\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "nueva entrada"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "nueva salida"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "Ignorando las claves ESP ya que el soporte ESP no está disponible en esta "
 "versión\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Sólo lectura de 1 byte del campo de longitud oNCP\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "El servidor terminó la conexión (la sesión ha finalizado)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "El servidor terminó la conexión (razón: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "El servidor envió longitud cero al registro oNCP\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "Mensaje KMP entrante %d de tamaño %d (tiene %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 "Continuar para procesar el mensaje KMP %d ahora el tamaño es %d (tiene %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Paquete de datos no reconocido\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Mensaje KMP desconocido %d de tamaño %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d bytes más sin recibir\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Paquete saliente:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Enviado paquete de control de activación\n"
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "Error: llamada a %s() con UTF-8 no válido para el argumento «%s»\n"
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Falló al crear SSL_SESSION ASN.1 para OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "OpenSSL falló al analizar SSL_SESSION ASN.1\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Falló al inicializar la sesión DTLSv1\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Falló al inicializar DTLSv1 CTX\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Falló al establecer la lista de cifrado DTLS\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "No precisamente un cifrado DTLS\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() falló con el protocolo antiguo 0x%x\n"
+"¿Está usando una versión de OpenSSL más antigua que la 0.9.8m?\n"
+"Consulte http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use la opción de la línea de comandos --no-dtls para evitar este mensaje\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "Establecida la conexíon DTLS (usando OpenSSL). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Su versión de OpenSSL es anterior a la que usó para compilar, por lo que "
+"DTLS podría fallar."
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Esto es probablemente debido a que su OpenSSL está roto\n"
+"Consulte http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Falló la negociación DTLS: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Falló al inicializar el cifrado ESP\n"
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr "Falló al inicializar ESP HMAC\n"
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr "Falló al generar las claves aleatorias para ESP:\n"
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 "Falló al establecer el contexto para el descifrado de el paquete ESP:\n"
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr "Falló al descifrar el paquete ESP:\n"
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr "Falló al generar el VI aleatorio para el paquete ESP:\n"
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr "Falló al establecer el contexto de cifrado para el paquete ESP:\n"
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr "Falló al cifrar el paquete ESP:\n"
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr "Falló al establecer el contexto PKCS#11 de libp11:\n"
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr "Falló al cargar el módulo del proveedor PKCS#11 (%s):\n"
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN bloqueado\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN caducado\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Otro usuario ya ha iniciado sesión\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr "Error desconocido al iniciar sesión en el testigo PKCS#11\n"
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr "Sesión iniciada en el slot PKCS#11 «%s»\n"
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr "Falló al enumerar los certificados en la ranura PKCS#11 «%s»\n"
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr "Encontrados %d certificados en la ranura «%s»\n"
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr "Falló al analizar el URI PKCS#11 '%s'\n"
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr "Falló al enumerar las ranuras PKCS#11\n"
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr "Sesión iniciada en la ranura PKCS#11 «%s»\n"
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "libp11 no pudo obtener el contenido del certificado X.509\n"
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Falló al instalar el certificado en el contexto de OpenSSL\n"
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr "Falló al enumerar las claves en la ranura PKCS#11 «%s»\n"
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr "Encontradas %d claves en la ranura «%s»\n"
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr "Falló al instancia la clave privada desde PKCS#11\n"
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr "Falló al añadir clave desde PKCS#11\n"
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Esta versión de OpenConnect se compiló sin soporte de PKCS#11\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Falló al escribir en el socket SSL\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Falló al leer del socket SSL\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Error de lectura SSL %d (probablemente el servidor cerró la conexión); "
 "reconectando.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "Falló el SSL_write: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Tipo %d de solicitud SSL UI no gestionado\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Contraseña PEM demasiado larga (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Certificado extra desde %s: «%s»\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Falló el análisis PKCS#12 (vea los errores anteriores)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 no contiene certificado\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 no contiene clave privada\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "No se puede cargar el motor TPM.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Falló al iniciar el motor TPM\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Falló al establecer la contraseña TPM SRK\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Falló al cargar la clave privada TPM\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Falló al añadir clave desde TPM\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Falló al abrir el archivo de certificado %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Falló la carga del certificado\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Falló al procesar todos los certificados soportados. Intentándolo de todas "
 "formas...\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "Archivo PEM"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Falló al crear BIO para el elemento «%s» del almacén de claves\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Carga de la clave privada fallida (¿contraseña incorrecta?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Falló al cargar la clave privada (vea los errores de arriba)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Falló al cargar el certificado X509 del almacén de claves\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Falló al usar el certificado X509 del almacén de claves\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Falló al usar la clave privada del almacén de claves\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Falló al abrir el archivo de clave privada %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Falló al cargar la clave privada\n"
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Falló al identificar el tipo de clave privada en «%s»\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Coincidencia en el altname DNS «%s»\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Sin coincidencias para el altname «%s»\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "El certificado tiene el altname GEN_IPADD con longitud errónea %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Coincidencia %s en la dirección «%s»\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Sin coincidencias para %s dirección «%s»\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "El URI «%s» no tiene una ruta vacía; se ignora\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Coincidió el URI «%s»\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Sin resultado para el URI «%s»\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Ningún altname en el certificado del par coincidió con «%s»\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "¡Sin nombre del sujeto en el certificado del par!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Falló al analizar el nombre del sujeto en el certificado del par\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "El sujeto del certificado del par no coincide («%s» != «%s»)\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Coincidió el nombre del sujeto del certificado del par «%s»\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Certificado extra desde cafile: «%s»\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Error en el campo notAfter del certificado del cliente\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Falló al leer certificados desde el archivo CA «%s»\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Falló al abrir el archivo CA «%s»\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Fallo en conexión SSL\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Falló al calcular OATH HMAC\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Descartar mala división que incluir: «%s»\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Descartar mala división que excluir: «%s»\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Falló al generar el script '%s' para %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "El script '%s' terminó anormalmente (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "El script '%s' devolvió el error %d\n"
@@ -3703,87 +3877,99 @@ msgstr "Formato de pin no válido; inténtelo de nuevo.\n"
 msgid "Generating RSA token code\n"
 msgstr "Generando código de testigo RSA\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Error al acceder a la clave del registro para adaptadores de red\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Ignorando la interfaz TAP que no coincide «%s»\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 "No se han encontrado adaptadores TAP de Windows. ¿Está instalado el "
 "controlador?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Falló al abrir: %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Dispositivo TUN %s abierto\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Falló al obtener la versión del driver TAP: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Error: se necesita la versión 9.9 o superior del controlador TAP de Windows "
 "(encontrada la %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Falló al establecer las direcciones IP TAP: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Falló al establecer el estado del medio TAP: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "El dispositivo TAP ha abortado la conectividad. Desconectando.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Falló al leer del dispositivo TAP: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Falló al completar la lectura del dispositivo TAP: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Escritos %ld bytes en tun\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Esperando la escritura de TUN...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Escritos %ld bytes en TUN después de esperar\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Falló al escribir en el dispositivo TAP: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Windows todavía no soporta la generación de scripts del túnel\n"
 
diff --git a/po/es_CR.po b/po/es_CR.po
index e21da35b..0f7792ba 100644
--- a/po/es_CR.po
+++ b/po/es_CR.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Spanish (Costa Rica) (http://www.transifex.net/projects/p/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/es_MX.po b/po/es_MX.po
index 083c4304..11d75cd5 100644
--- a/po/es_MX.po
+++ b/po/es_MX.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Spanish (Mexican) (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/et.po b/po/et.po
index 87c996b3..490caa20 100644
--- a/po/et.po
+++ b/po/et.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Estonian (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/eu.po b/po/eu.po
index ca8ca508..056bc554 100644
--- a/po/eu.po
+++ b/po/eu.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-20 08:43+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Basque (http://www.transifex.net/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr "Pasahitza eskatu da baina '--no-passwd' ezarri da\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Huts egin du '%s'(r)ekin HTTPS konexioa irekitzean\n"
@@ -309,553 +309,483 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "Errorea: ezin dira socket-ak hasieratu\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO %d rcv_mss, %d snd_mss, %d advmss, %d pmtu\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG: %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Errorea HTTPS erantzuna jasotzean\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN zerbitzua ez dago erabilgarri. Zergatia: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "HTTP CONNECT erantzun desegokia jasota: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "CONNECT erantzuna jasota: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Ez dago memoriarik aukerentzako\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<saihestuta>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "'X-DTLS-Session-ID'-ak ez ditu 64 karaktere. Hau du: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "%s CSTP-Content-Encoding ezezaguna\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Ez da MTU jaso. Abortatzen\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Ez da IP helbiderik jaso. Abortatzen\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Birkonektatzeak IP helbide zahar desberdina eman du (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "Birkonektatzeak IP sareko maskara zahar desberdina eman du (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Birkonektatzeak IPv6 helbide desberdina eman du (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Birkonektatzeak  IPv6 sareko maskara desberdina eman du (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP konektatuta. %d DPD, %d Keepalive\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Huts egin du konpresioa konfiguratzean\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Huts egin du bufferraren hustuketa esleitzean\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "huts egin du puztean\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "Huts egin du %d hustean\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 "Paketearen ustekabeko luzera. 'SSL_read'-ek %d itzuli du, baina paketea hau "
 "da:\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "CSTP DPD eskaera jasota\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "CSTP DPD erantzuna jasota\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "CSTP Keepalive jasota\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Konprimitu gabeko datuen paketea (%d byte) jasota\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Zerbitzariaren deskonexioa jasota:  %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Konprimitutako paketea !hustu (!deflate) moduan jasota\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "zerbitzariaren amaierako paketea jasota\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Pakete ezezaguna: %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL-ek byte gutxiegi idatzita. %d eskatu ziren, %d bidalita\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP gakoa birnegoziatzeko zain\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Huts egin du berriro negoziatzean. Tunel berriarekin saiatzen\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTPren DPDak hildako parekoa atzeman du\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Huts egin du birkonektatzean\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Bidali CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Bidali CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Konprimitu gabeko datuen paketea (%d byte) bidaltzen\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Bidali BYE paketea: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Huts egin du DTLSv1 saioa hasieratzean\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Huts egin du DTLSv1 CTX hasieratzean\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Huts egin du DTLS zifraketaren zerrenda ezartzean\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Ez da DTLS zifraketa bat hain zuzen\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() funtzioak huts egin du 0x%x bertsioko protokolo "
-"zaharrarekin\n"
-"0.9.8m baino zaharragoa den OpenSSL-ren bertsioa erabiltzen ari zara?Ikus "
-"http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Erabili komando-lerroaren '--no-dtls' aukera mezu hau saihesteko\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "DTLS konexioa ezarrita (OPenSSL erabiliz). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Sistemako OpenSSL konpilatzean erabilitakoa baino zaharragoa da, DTLS-ek "
-"huts egin dezake."
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS negoziazioaren denbora iraungituta\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Baliteke sistemako OpenSSL-a hautsita egotea\n"
-"Ikus http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "Huts egin du DTLS negoziatzean: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "'%s' CipherSuite eskaeraren DTLS parametro ezezagunak\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Huts egin du DTLSren lehentasuna ezartzean: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Huts egin du DTLS saioaren parametroak ezartzean: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Huts egin du DTLS MUT ezartzean: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "DTLS konexioa ezarrita (GnuTLS erabiliz). '%s' Ciphersuite\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Huts egin du DTLS negoziatzean: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "DTLS konexioaren saiakera existitzen den deskriptore batekin\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "DTLS helbiderik gabe\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Zerbitzariak ez du DTLS zifraketaren aukerarik eskaini\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "DTLSrik gabe proxy bidez konektatzean\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLSren '%s : %s'  aukera\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS hasieratuta. %d DPD, %d Keepalive\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "DTLS konexio berriaren saiakera\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "DTLSren 0x%02x paketea (%d byte) jasota\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "DTLS DPD eskaera lortuta\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Huts egin du DPD erantzuna bidaltzean. Deskonektatzea espero da\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "DTLS DPD erantzuna jasota\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "DTLS Keepalive jasota\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "%02x DTLS pakete mota ezezaguna, %d luzera\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLSren gakoa birnegoziatzeko zain\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Huts egin du DTLS berriro negoziatzean. Birkonektatzen.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLSren DPDak hildako parekoa atzeman du\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Bidali DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Huts egin du DPD eskaera bidaltzean. Deskonektatzea espero da\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Bidali DTLS Keepalive\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Huts egin du Keepalive eskaera bidaltzean. Deskonektatzea espero da\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Pakete ezezaguna (%d luzerakoa) jasota: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLSek idazketaren %d errorea jaso du. SSLra itzultzen\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLSek idazketaren errorea jaso du: %s. SSLra itzultzen\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "DTLS paketea bidalita (%d byte). DTLSren bidalketak %d itzuli du\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgstr ""
+
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -957,6 +887,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "'%s' CipherSuite eskaeraren DTLS parametro ezezagunak\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Huts egin du DTLSren lehentasuna ezartzean: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Huts egin du DTLS saioaren parametroak ezartzean: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Huts egin du DTLS MUT ezartzean: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "DTLS konexioa ezarrita (GnuTLS erabiliz). '%s' Ciphersuite\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS negoziazioaren denbora iraungituta\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Huts egin du DTLS negoziatzean: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -977,7 +998,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -996,7 +1017,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL-ren idazketa bertan behera utzi da\n"
 
@@ -1005,489 +1026,493 @@ msgstr "SSL-ren idazketa bertan behera utzi da\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Huts egin du SSL socket-ean idaztean: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL-ren irakurketa bertan behera utzi da\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "SSL socket-a ez da ongi itxi\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Huts egin du SSL socket-etik irakurtzean: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Errorea SSL irakurketan: %s. Birkonektatzen.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "Huts egin du SSL bidaltzean: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Ezin izan da ziurtagiritik iraungitze-data erauzi\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Bezeroaren ziurtagiria iraungituta: "
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Bezeroaren ziurtagiria iraungitze-data laster: "
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Huts egin du '%s' elementua gako-biltegitik kargatzean: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Huts egin du '%s' gako-/ziurtagiri-fitxategia ireki: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 "Huts egin du '%s' gako-/ziurtagiri-fitxategiaren estatistikak lantzean: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Huts egin du ziurtagiriaren bufferra esleitzean\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Huts egin du ziurtagiria memorian irakurtzean: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Huts egin du PKCS#12 datuen egitura konfiguratzean: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Huts egin du PKCS#12 ziurtagiri-fitxategia desenkriptatzean\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Sartu PKCS#12 pasaesaldia:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Huts egin du PKCS#12 fitxategia prozesatzean: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Huts egin du PKCS#12 ziurtagiria kargatzean: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Huts egin du X509 ziurtagiria inportatzean: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Huts egin du PKCS#11 ziurtagiria ezartzean: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Ezin izan da MD5 hash-a hasieratu: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "MD5 hash-aren errorea: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Enkriptatutako gakoaren OpenSSL 'DEK-Info:' goiburua  falta da\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Ezin da PEM enkriptatze mota zehaztu\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Onartu gabeko PEM enkriptatze mota: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Baliogabeko hazia enkriptatutako PEM fitxategian\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Errorea enkriptatutako PEM fitxategia base64 moduan deskodetzean: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Enkriptatutako PEM fitxategia laburregia\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 "Huts egin du desenkriptatutako PEM fitxategia zifratzeko hasieratzean: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Huts egin du PEM gakoa desenkriptatzean: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Huts egin du PEM gakoa desenkriptatzean\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Sartu PEM pasaesaldia:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Bitar hau PKCS#11 euskarririk gabe eraikita dago\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "'%s' PKCS#11 ziurtagiria erabiltzen\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Errorea PKCS#11-tik ziurtagiria kargatzean: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "'%s' ziurtagiri-fitxategia erabiltzen\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "PKCS#11 fitxategiak ez dauka ziurtagiririk\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Ez da ziurtagiririk aurkitu fitxategian"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Huts egin du ziurtagiria kargatzean: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Errorea gako pribatuaren egitura hasieratzean: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Errorea PKCS#12 gako-egitura hasieratzean: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Errorea '%s' PKCS#11 URLa inportatzean: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "'%s' PKCS#11 gakoa erabiltzen\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Errorea PKCS#11 gakoa gako pribatuaren egiturara inportatzean: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "'%s' gako pribatuaren fitxategia erabiltzen\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Openconnect-en bertsio hau 'TPM' euskarririk gabe konpilatuta\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Huts egin du PEM fitxategia interpretatzean\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Huts egin du PKCS#1 gako pribatua kargatzean: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Huts egin du gako pribatua PKCS#8 gisa kargatzean: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Huts egin du PKCS#8 ziurtagiriaren fitxategia desenkriptatzean\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Huts egin du '%s' gako pribatuaren mota zehaztean\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Sartu PKCS#8 pasaesaldia:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Huts egin du ID gakoa eskuratzean: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Errorea probako datuak gako pribatuarekin sinatzean: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Errorea ziurtagiriaren aurka sinadura egiaztatzean: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Ez da gako pribatuarekin bat datorren SSL ziurtagiririk aurkitu\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "'%s' ziurtagiriaren bezeroa erabiltzen\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Huts egin du ziurtagiriaren errebokazio-zerrenda ezartzean: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Huts egin du memoria esleitzean ziurtagiriarentzako\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "Abisua: GNUTLS-ek ziurtagirien okerreko jaulkitzailea itzuli du. "
 "Autentifikazioak huts egin lezake\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "'%s' ZE hau lortu da PKCS#11-tik\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Huts egin du ziurtagiriak onartzeko memoria esleitzean\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "'%s' ZE euskarria gehitzen\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Huts egin du ziurtagiriaren ezarpenak: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Zerbitzariak ez du ziurtagiririk aurkeztu\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Errorea X509 ziurtagiriaren egitura hasieratzean\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Errorea zerbitzariaren ziurtagiria inportatzean\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Errorea zerbitzariaren ziurtagiriaren egoera aztertzean\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "ziurtagiria errebokatuta"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "ez da sinatzailerik aurkitu"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "sinatzailea ez da ZE-ren ziurtagiri bat"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "algoritmo ez-segurua"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "ziurtagiria ez da oraindik aktibatu"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "ziurtagiria iraungituta"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "huts egin du sinadura egiaztatzean"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "ziurtagiria ez dator bat ostalari-izenarekin"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Huts egin du zerbitzariaren ziurtagiria egiaztatzean: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Huts egin du cafile ziurtagirientzako memoria esleitzean\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Huts egin du cafile-tik ziurtagiriak irakurtzean: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Huts egin du '%s' ZE fitxategia irekitzean: %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Huts egin du ziurtagiria kargatzean. Bertan behera uzten.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL '%s'(r)ekin negoziatzen\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL konexioa bertan behera utzita\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL konexioaren hutsegitea: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS-ren itzulera ez-larria negoziazioan: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "HTTPSra konektatuta '%s'(e)n\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "SSL berriro negoziatuta %s(e)n\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "'%s'(r)en PINa behar da"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Okerreko PINa"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Azken saiakera da blokeatu aurretik."
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Saiakera gutxi batzuk falta dira blokeatu aurretik."
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Sartu PINa:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1681,7 +1706,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1699,236 +1724,236 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Ez dago memoriarik cookie-ak esleitzeko\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Huts egin du '%s' HTTParen erantzuna analizatzean\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "HTTParen erantzun hau lortu da: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Errorea HTTParen erantzuna prozesatzean\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "HTTParen erantzunaren '%s' lerroari ez ikusi egiten\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Baliogabeko cookie-a eskaini da: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Huts egin du SSL ziurtagiria autentifikatzean\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Erantzunaren gorputzak tamaina negatiboa du (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Transferentziaren kodeketa ezezaguna: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "'%s' HTTParen gorputza (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Errorea HTTParen erantzunaren gorputza irakurtzean\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Errorea zatiaren goiburua eskuratzean\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Errorea HTTParen erantzunaren gorputza eskuratzean\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Errorea deskodeketaren zatian. '' espero zen, bana hau lortu da: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Ezin da HTTP 1.0-ren gorputza eskuratu konexioa itxi gabe\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Huts egin du birbideratutako '%s' URLa analizatzean: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Ezin da https ez den '%s' URLaren birbideraketara jarraipenik egin\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 "Huts egin du birbideraketa erlatiboaren bide-izen berria esleitzean: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Ustekabeko %d emaitz zerbitzaritik\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "eskaera baimenduta"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "hutsegite orokorra"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "arau-multzoak ez du konexioa baimendu"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "sarea atziezina"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "ostalaria atziezina"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "helburuko ostalariak konexioa ukatu du"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL iraungituta"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "komandoa ez dago onartuta / protokoloaren errorea"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "helbide mota ez dago onartuta"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Errorea autentifikazioaren eskaera SOCKS proxy-an idaztean: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Errorea autentifikazioaren erantzuna SOCKS proxy-tik irakurtzean: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Ustekabeko autentifikazioaren eskaera SOCKS proxy-tik: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "SOCKS proxy-aren '%s:%d'(r)ekiko konexioa eskatzen\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Errorea konexioaren eskaera SOCKS proxyan idaztean: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Errorea SOCKS proxytik konexioaren erantzuna irakurtzean: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Ustekabeko SOCKS proxyaren konexioaren erantzuna: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS proxy-aren '%02x' errorea: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS proxy-aren '%02x' errorea\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Ustekabeko %02x helbide mota SOCKS konexioaren erantzunean\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "HTTP proxy konexioa '%s:%d'(r)i eskatzen\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Huts egin du proxy eskaera bidaltzean: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "'%s' proxy mota ezezaguna\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Soilik HTTP edo socks(5) proxyak onartzen dira\n"
 
@@ -1941,70 +1966,83 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "SSL liburutegiarekin eraikita, Cisco-ren DTLS euskarririk gabe.\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Huts egin du '%s' zerbitzariaren URLa analizatzean\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Soilik 'https://' baimentzen da zerbitzariaren URLan\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Ez dago inprimakiaren kudeatzailerik: ezin da autentifikatu.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Huts egin du katea sarrera estandarretik esleitzean\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "OpenSSL erabiltzen. Dituen eginbideak:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "GnuTLS erabiltzen. Dituen eginbideak:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "Ez dago OpenSSL motorra"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "OpenSSL erabiltzen"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2014,31 +2052,31 @@ msgstr ""
 "ABISUA: ez dago DTLS euskarririk bitar honetan. Errendimenduan eragina "
 "izango du.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (sarrera_estandarra)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Ezin da '%s' bide-izen exekutagarria prozesatu"
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Huts egin du vpnc-script bide-izenaren esleipenak\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Erabilera: openconnect [aukerak] <zerbitzaria>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2047,307 +2085,307 @@ msgstr ""
 "Cisco AnyConnect VPN-ren bezero irekia, %s bertsioa\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Irakurri aukerak konfigurazio-fitxategitik"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Jarraitu atzeko planoan abiatu ondoren"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Idatzi daemon-aren PIDa fitxategi honetan"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Erabili SSL bezeroaren CERT ziurtagiria"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Abisatu ziurtagiriaren bizi-iraupena < EGUN denean"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Erabili SSL-ren gako pribatuaren KEY fitxategia"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Erabili WebVPN-ren COOKIE cookie-a"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Irakurri cookie-a sarrera estandarretik"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Gaitu konpresioa (lehenetsia)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Desgaitu konpresioa"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Ezarri  Hildako _Parekoen Detekzioaren (DPD) bitartea"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Ezarri saio-hasieraren erabiltzaile-taldea"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Bistaratu laguntzaren testua"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Erabili IFNAME tunelaren interfazearentzako"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Erabili sistemaren egunkaria (syslog) aurrerapenen mezuentzako"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Atxikitu denbora-zigilua aurretik aurrerapenen mezuei"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Jaregin pribilegioak konektatu ondoren"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Jaregin pribilegioak CSV exekutatzean"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Exekutatu SCRIPT, CSD bitarraren ordez"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Adierazi MTUren bide-izena zerbitzariari/zerbitzaritik"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Ezarri pasaesaldia edo TPM SRK PINa"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Gakoaren pasaesaldia fitxategi-sistemaren fsid-a da"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Ezarri proxy zerbitzaria"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Desgaitu proxy-a"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Erabili 'libproxy' proxy-a automatikoki konfiguratzeko"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(OHARRA: 'libproxy' desgaituta bertsio honetan)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Konfidentzialtasun iraunkorra (PFS) behar da"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Irteera laburragoa"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Mugatu paketeen ilara LEN (luzera) paketetara"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Komando-lerroa  vpnc-compatible konfigurazioaren script bat erabiltzeko"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "lehenetsia"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Igorri trafikoa 'script' programari, ez TUN-ari"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Ezarri erabiltzaile-izena"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Eman bertsio-zenbakiaren berri"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Irteera xehatuagoa"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Irauli HTTP autentifikazioaren trafikoa (--verbose inplikatzen du)"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML konfigurazio-fitxategia"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Aukeratu autentifikazioaren saio-hasieraren hautapena"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Autentifikatu soilik eta erakutsi saio-hasieraren informazioa"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Eskuratu webvpn cookie-a soilik; ez konektatu"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Erakutsi webvpn cookie-a konektatu aurretik"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Ziurtagiriaren fitxategia zerbitzaria egiaztatzeko"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Ez eskatu IPv6 konektagarritasuna"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "OpenSSL zifraketak DTLS onartzeko"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Desgaitu DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Desgaitu HTTP konexioa berrerabiltzea"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Desgaitu pasahitzaren/SecurID-ren autentifikazioa"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Ez eskatu zerbitzariaren SSLaren ziurtagiria egiaztatzeko "
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Ez saiatu XML POST-en autentifikazioa"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Ez itxaron erabiltzailearen sarrerarik; irten beharrezkoa izanez gero"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Irakurri pasahitza sarrera estandarretik"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Softwarearen token mota: 'rsa', 'totp' edo 'hotp'"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Softwarearen ezkutuko token-a"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(Oharra: 'libstoken' (RSA SecurID) desgaituta bertsio honetan)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Berriro konektatzeko saiakeraren denbora (segundotan)"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Zerbitzariaren ziurtagiriaren SHA1 hatz-maraka"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP goiburuaren 'User-Agent': eremua"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "SE mota (linux,linux-64,win,...) berri emateko"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Ezarri DTLS datagramen lokaleko ataka"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Huts egin du katea esleitzean\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Huts egin du konfigurazio-fitxategitik lerroa eskuratzean: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Aukera ezezaguna %d. lerroan: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "'%s' aukerak ez du argumentu bat hartzen %d. lerroan\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "'%s' aukerak argumentu bat behar du %d. lerroan\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2355,49 +2393,49 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Huts egin du vpninfo egitura esleitzean\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Ezin da 'config' aukera erabili konfigurazio-fitxategi barruan\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Ezin da '%s' konfigurazio-fitxategia ireki: %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "%d MTU txikiegia da\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2408,126 +2446,133 @@ msgstr ""
 "Honek lagun badezake, bidali honi buruzkoak helbide honetara: \n"
 "<openconnect-devel@lists.infradead.org>\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Ezin da ilararen luzera zero izan: 1 erabiltzen\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect '%s' bertsioa\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Baliogabeko softwarearen '%s' token modua\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Baliogabeko '%s' SE-aren identitatea\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Argumentu gehiegi komando-lerroan\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Ez da zerbitzaririk zehaztu\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Openconnect-en bertsio hau 'libproxy' euskarririk gabe konpilatuta\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Errorea 'cmd'-ren kanalizazioa irekitzean\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Huts egin du WebVPN cookie-a eskuratzean\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Huts egin du SSL konexioa sortzean\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Huts egin du DTLS konfiguratzean: horren ordez SSL erabiltzen\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Ez da --script argumenturik eman. DNSa eta bideratzea ez daude "
 "konfiguratuta.\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Ikus http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Huts egin du '%s' idazteko irekitzean: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Atzeko planoan jarraitzen du: %d PIDa\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Huts egin du '%s' idazteko irekitzean: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Huts egin du konfigurazioa '%s'(e)n idaztean: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "SSL zerbitzariaren ziurtagiria ez dator bat: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2538,90 +2583,101 @@ msgstr ""
 "Huts egin du '%s' VPN zerbitzariaren ziurtagiria egiaztatzean.\n"
 "Zergatia: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Sartu '%s' onartzeko, '%s' bertan behera uzteko; beste edozer hau ikusteko:"
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ez"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "bai"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Autentifikazioaren '%s' aukera hainbat aukerekin bat dator\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Autentifikazioaren '%s' aukera ez dago erabilgarri\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Erabiltzailearen sarrera behar da modu ez-elkarreragilean\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Softwarearen tokenaren katea baliogabea da\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Ezin da ~/.stokenrc fitxategia ireki\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect ez zen 'libstoken' euskarriarekin konpilatu\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Hutsegite orokorra 'libstoken' liburutegian\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect ez zen 'liboath' euskarriarekin konpilatu\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Hutsegite orokorra 'liboath' liburutegian\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2636,16 +2692,16 @@ msgstr "Huts egin du 'tun' script-a konfiguratzean\n"
 msgid "Set up tun device failed\n"
 msgstr "Huts egin du TUN gailua konfiguratzean\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Deitzaileak konexioa pausatu du\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Lanik ez egiteko. %d ms lotan...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "'WaitForMultipleObjects'-ek  huts egin du: %s\n"
@@ -2712,7 +2768,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "OATH TOTP tokenaren kodea sortzen\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "OATH HOTP tokenaren kodea sortzen\n"
 
@@ -2844,504 +2900,622 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Huts egin du DTLSv1 saioa hasieratzean\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Huts egin du DTLSv1 CTX hasieratzean\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Huts egin du DTLS zifraketaren zerrenda ezartzean\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Ez da DTLS zifraketa bat hain zuzen\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() funtzioak huts egin du 0x%x bertsioko protokolo "
+"zaharrarekin\n"
+"0.9.8m baino zaharragoa den OpenSSL-ren bertsioa erabiltzen ari zara?Ikus "
+"http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Erabili komando-lerroaren '--no-dtls' aukera mezu hau saihesteko\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "DTLS konexioa ezarrita (OPenSSL erabiliz). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Sistemako OpenSSL konpilatzean erabilitakoa baino zaharragoa da, DTLS-ek "
+"huts egin dezake."
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Baliteke sistemako OpenSSL-a hautsita egotea\n"
+"Ikus http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Huts egin du DTLS negoziatzean: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Huts egin du SSL socket-ean idaztean\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Huts egin du SSL socket-etik irakurtzean\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "SSL irakurketaren %d errorea (baliteke zerbitzariak konexioa ixtea). "
 "Birkonektatzen.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "'SSL_write'-k huts egin du: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM pasahitza luzeegia da (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "%s-ren ziurtagiri gehigarria: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Huts egin du PKCS#12 analizatzean (ikus gaineko errorak)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 ez dauka ziurtagiririk.\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 ez dauka gako pribaturik.\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Ezin da TPM motorra kargatu.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Huts egin du TPM motorra hasieratzean\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Huts egin du TPM SRK pasahitza ezartzean\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Huts egin du TPMren gako probatua kargatzean\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Huts egin du TPMtik gakoa gehitzean\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Huts egin du '%s' ziurtagiri-fitxategia irekitzean: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Huts egin du ziurtagiria kargatzean\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Huts egin du gako-biltegiko '%s' elementuaren BIO-a sortzean\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Huts egin du gako pribatua kargatzean (okerreko pasaesaldia?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Huts egin du gako pribatua kargatzean (ikus goiko erroreak)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Huts egin du X509 ziurtagiria gakoen biltegitik kargatzean\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Huts egin du X509 ziurtagiria gakoen biltegitik erabiltzean\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Huts egin du gako pribatua gakoen biltegitik erabiltzean\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Huts egin du gako pribatuaren '%s' fitxategia irekitzean: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Huts egin du gako pribatuaren mota identifikatzean '%s'(e)n\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "'%s' DNS ordezko izenarekin bat dator\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Ez dago '%s' DNS ordezko izenarekin bat datorrenik\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Ziurtagiriak ordezko GEN_IPADD izena du okerreko %d luzerarekin\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "%s helbide bat datoz '%s'(r)ekin\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Ez dago bat datorrenik %s '%s' helbideekin\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "'%s' URIak ez du hutsak ez diren bide-izenik. Ez ikusi egiten\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "'%s' URIarekin bat dator\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Ez dago '%s' URIarekin bat datorrenik\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 "Ez dago '%s'(r)ekin bat datorren ordezko izenik parekoaren ziurtagirian\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Parekoaren ziurtagiriak ez du subjektuaren izenik\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Huts egin du parekoaren ziurtagirian subjektuaren izena analizatzean\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Parekoaren ziurtagiriaren subjektua falta da ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Parekoaren ziurtagiriaren '%s' subjektuaren izena bat dator\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "cafile-ren ziurtagiri gehigarria: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Errorea bezeroaren ziurtagiriko 'notAfter' eremuan\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<errorea>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Huts egin du '%s' ZE fitxategitik ziurtagiriak irakurtzean\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Huts egin du '%s' ZE fitxategia irekitzean\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL konexioaren hutsegitea\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Okerreko zatitzea baztertzeak hau dauka: '%s'\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Okerreko zatitzea baztertzeak ez dauka hau: '%s'\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Huts egin du '%2$s'(r)en '%1$s' scripta sortzean: %3$s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "'%s' scripta ustekabean amaitu da (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "'%s' script-ak %d errorea itzuli du\n"
@@ -3638,86 +3812,98 @@ msgstr "PINaren formatua baliogabea. Saiatu berriro.\n"
 msgid "Generating RSA token code\n"
 msgstr "RSA tokenaren kodea sortzen\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Errorea sareko moldagailuentzako erregistroaren gakoa atzitzean\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 "Ez da Windows-TAP moldagailurik aurkitu. Kontrolatzailea instalatuta dago?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Huts egin du '%s' irekitzean\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "'%s' tun gailua irekita\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Huts egin du TAP kontrolatzailearen bertsioa eskuratzean: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Errorea: TAP-Windows v9.9 or handiagoa den kontrolatzailea behar da. "
 "Aurkitutakoa: %ld.%ld\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Huts egin du TAP IP helbideak ezartzean: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Huts egin du TAP euskarriaren egoera ezartzean: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Huts egin du TAP gailutik irakurtzean: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Huts egin du TAP gailutik erabat irakurtzean: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "%ld byte 'tun'-en idatzita\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "'tun'-ek idatzi zain...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "'tun'-en %ld byte idatzita zain egon ondoren\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Huts gin du TAP gailuan idaztean: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Tunelaren script-ak sortzea ez dago oraindik onartuta Windows-en\n"
 
diff --git a/po/fa.po b/po/fa.po
index eb139f10..ff1ba405 100644
--- a/po/fa.po
+++ b/po/fa.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Persian (http://www.transifex.net/projects/p/meego/team/fa/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/fi.po b/po/fi.po
index d6ffae1c..d528095b 100644
--- a/po/fi.po
+++ b/po/fi.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-20 08:43+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Finnish <gnome-fi-laatu@lists.sourceforge.net>\n"
@@ -174,7 +174,7 @@ msgstr "Kysyttiin salasanaa, mutta valitsin '--no-passwd' asetettu\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "HTTPS-yhteyden muodostus kohteeseen %s epäonnistui\n"
@@ -301,541 +301,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Virhe luotaessa HTTPS CONNECT -pyyntöä\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Virhe noutaessa HTTPS-vastausta\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN-palvelu ei ole käytettävissä; syy: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "IP-osoitetta ei saatu. Keskeytetään\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Uudelleenyhdistys epäonnistui\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Lähetä BYE-paketti: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Ei DTLS-osoitetta\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Ei DTLS:ää välityspalvelimen kautta yhdistettäessä\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
-msgstr "SSL-toimenpide peruttiin\n"
-
-#: dtls.c:1169
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:531
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
+msgstr ""
+
+#: dtls.c:544
+#, c-format
+msgid "Failed to send DPD request (%d %d)\n"
+msgstr ""
+
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -937,6 +876,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -957,7 +987,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -976,7 +1006,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -985,485 +1015,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Käytetään PKCS#11-varmennetta %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "Käytetään järjestelmävarmennetta %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Käytetään varmennetiedostoa %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "varmenne on kumottu"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "allekirjoittajaa ei löydy"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "varmennetta ei ole vielä aktivoitu"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "varmenne on vanhentunut"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL-yhteys peruttu\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL-yhteys epäonnistui: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Väärä PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Anna PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1657,7 +1691,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1675,235 +1709,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "HTTP-vastauksen '%s' jäsentäminen epäonnistui\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Saatiin HTTP-vastaus: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Virhe käsiteltäessä HTTP-vastausta\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "yleinen virhe"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL vanheni"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "komento ei ole tuettu / yhteyskäytännön virhe"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1916,407 +1950,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() epäonnistui: %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "käytetään OpenSSL:ää"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "oletus"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML-asetustiedosto"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Ohjelmistopohjaisen tokenin salaisuus"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2324,173 +2371,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Palvelinta ei ole määritetty\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "SSL-yhteyden luominen epäonnistui\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Tuntematon virhe, poistutaan.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2501,89 +2555,100 @@ msgstr ""
 "Varmenne VPN-palvelimelta \"%s\" ei läpäissyt vahvistusta.\n"
 "Syy: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ei"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "kyllä"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Tiedostoa ~/.stokenrc ei voi avata\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2598,16 +2663,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2673,7 +2738,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2805,501 +2870,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "uusi saapuva"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "uusi lähtevä"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN lukittu\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN vanhentunut\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Toinen käyttäjä on jo kirjautuneena\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write epäonnistui: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "PEM-tiedosto"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL-yhteys epäonnistui\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3596,83 +3770,95 @@ msgstr "Virheellinen PIN-muoto, yritä uudelleen.\n"
 msgid "Generating RSA token code\n"
 msgstr "Luodaan RSA-tokenin koodia\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/fr.po b/po/fr.po
index c0f08f86..23cadd72 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-07-17 08:17+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: French (http://www.transifex.com/projects/p/meego/language/"
@@ -173,7 +173,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -300,541 +300,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Paquet inconnu %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -936,6 +875,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -956,7 +986,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -975,7 +1005,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -984,485 +1014,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Négociation SSL avec %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1656,7 +1690,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1674,235 +1708,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL expiré"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1915,407 +1949,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Utiliser le cookie WebVPN COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Activer la compression (par défaut)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Désactiver la compression"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Sélectionner le serveur proxy"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Désactiver le proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Utiliser libproxy pour configurer le proxy automatiquement"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Fichier configuration XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Désactiver DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Désactiver la réutilisation de la connexion HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2323,173 +2370,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "Version %s de OpenConnect\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Pas de serveur spécifié\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2497,89 +2551,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "non"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "oui"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2594,16 +2659,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2669,7 +2734,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2801,501 +2866,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Impossible d'ouvrir le fichier CA '%s'\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3592,83 +3766,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ga.po b/po/ga.po
index 6519242a..cd1a2d91 100644
--- a/po/ga.po
+++ b/po/ga.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Irish (http://www.transifex.com/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/gd.po b/po/gd.po
index 46f0aa80..e52ff3e8 100644
--- a/po/gd.po
+++ b/po/gd.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Gaelic, Scottish (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/gl.po b/po/gl.po
index ed8d4e65..0adb3f72 100644
--- a/po/gl.po
+++ b/po/gl.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Galician (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Produciuse un fallo ao inicializar DTLSv1 CTX\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,70 +1947,83 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Fallo de asignación para a cadea desde stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Ao usar OpenSSL. Existen estas características:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Ao usar GnuTLS. Existen estas características:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "MOTOR OpenSSL non presente"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "usando OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -1986,338 +2033,338 @@ msgstr ""
 "AVISO: non existe compatibilidade con DTLS. O rendemento pode verse "
 "perxudicado.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Uso: openconnect [opcións] <servidor>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr "Abrir cliente para Cisco AnyConnect VPN, versión %s\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Ler opcións desde un ficheiro de configuración"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Continuar en segundo plano despois do inicio"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Escribir o PID do daemon neste ficheiro"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Usar o certificado CERT do cliente SSL"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Avisar cando a vida do certificado < DÍAS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Usar ficheiro de chave privada SSL KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Usar WebVPN cookie COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Ler cookie desde a entrada estándar"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Activar compresión (predeterminado)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Desactivar compresión"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Estabelecer o grupo de usuario de inicio de sesión"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Mostrar o texto de axuda"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Usar IFNAME para a interface de túnel"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Usar syslog para as mensaxes de progreso"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Quitar privilexios despois de conectarse"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Quitar privilexios durante a execución de CSD"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Executar SCRIPT no lugar do binario CSD"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indica a ruta MTU ao/desde o servidor"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Estabelecer a frase de paso da chave ou PIN do TPM SRK"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "A frase de paso da chave é o fsid do sistema de ficheiros"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Estabelecer servidor proxy"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Desactivar proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Usar libproxy para configurar automaticamente o proxy"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTA: libproxy desactivado para esta compilación)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Menos saída"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "predeterminado"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Pasar o tráfico ao programa «script», non tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Estabelecer o nome de usuario de inicio de sesión"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Informar do número de versión"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Máis saída"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Ficheiro de configuración XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Escoller selección da autenticación do inicio de sesión "
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Só autenticar e imprimir a información de inicio de sesión"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Ficheiro de certificado para a verificación do servidor"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Non preguntar pola conectividade de IPv6"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Desactivar DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Desactivar a reutilización da conexión HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Desactivar a autenticación por contrasinal/SecurID"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Non requirir que o certificado SSL do servidor sexa válido"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Non tentar a autenticación XML por POST"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Non agardar entrada do usuario; saír se se require"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Ler contrasinal da entrada estándar"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Token de software segredo"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(NOTA: libtoken (RSA SecurID) desactivado para esta compilación)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Tempo de espera do reintento de conexión en segundos"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Pegada dixital SHA1 do certificado do servidor"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Campo da cabeceira HTTP User-Agent:"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Estabelecer o porto local para os datagramas de DTLS"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 "Produciuse un fallo ao obter a liña desde o ficheiro de configuración: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Opción non recoñecida na liña %d: «%s»\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "A opción «%s» non recolle un argumento na liña %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "A opción «%s» require un argumento na liña %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2325,177 +2372,184 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Produciuse un fallo na asignación da estrutura vpninfo.\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 "Non foi posíbel usar a opción «config» dendo do ficheiro de configuración\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Non é posíbel abrir o ficheiro de configuración «%s»: %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d demasiado pequeno\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Non se permite a lonxitude cola cero; usando 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect versión %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Modo de token de software «%s» non válido\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Identidade do SO «%s» non válida\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Demasiados argumentos na liña de ordes\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Non se especificou ningún servidor\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 "Esta versión de openconnect foi compilada sen compatibilidade para libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Produciuse un fallo ao obter a cookie de WebVPN\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Produciuse un fallo na creación da conexión SSL\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Produciuse un fallo na configuración de DTLS; usando SSL no lugar\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Non se forneceu ningún argumento --script; DNS o enrutado non están "
 "configurados\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Vexa http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Produciuse un erro ao abrir «%s» para escritura: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Continuando en segundo plando; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Produciuse un erro ao abrir %s para escritura: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Produciuse un fallo ao escribir a configuración en %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2506,90 +2560,101 @@ msgstr ""
 "Non foi posíbel verificar o certificado do servidor VPN «%s».\n"
 "Razón: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Escriba «%s» para aceptar, «%s» para abortar; calquera outra cousa para ver: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "non"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "si"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Elección de autenticación «%s» non dispoñíbel\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Entrada de usuario requirida no modo non-interactivo\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "A cadea do token de software non é válida\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Non é posíbel abrir o ficheiro ~/.stokenrc\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect non foi construido con compatibilidade de libstoken\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Fallo xeran en libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect non foi construido con compatibilidade de liboath\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Fallo xeran en liboath\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2604,16 +2669,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr "Produciuse un fallo na configuración do dispositivo tun\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2679,7 +2744,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2811,501 +2876,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Produciuse un fallo ao inicializar DTLSv1 CTX\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3602,83 +3776,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/gu.po b/po/gu.po
index 711bae27..5737be75 100644
--- a/po/gu.po
+++ b/po/gu.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Gujarati (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/he.po b/po/he.po
index 7f880e57..c2ee81f8 100644
--- a/po/he.po
+++ b/po/he.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Hebrew (http://www.transifex.net/projects/p/meego/team/he/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/hi.po b/po/hi.po
index 5f51f067..050ece53 100644
--- a/po/hi.po
+++ b/po/hi.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Hindi (http://www.transifex.net/projects/p/meego/team/hi/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/hi_IN.po b/po/hi_IN.po
index 96462cb1..0ba4ddaa 100644
--- a/po/hi_IN.po
+++ b/po/hi_IN.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Hindi (India) (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/hr.po b/po/hr.po
index c0734803..e1a6fc86 100644
--- a/po/hr.po
+++ b/po/hr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Croatian (http://www.transifex.com/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/hu.po b/po/hu.po
index d7631928..c3689625 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-09-27 08:09+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Hungarian (http://www.transifex.net/projects/p/meego/team/"
@@ -176,7 +176,7 @@ msgstr "Jelszót kértek, de „--no-passwd” van beállítva\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Nem kerül letöltésre az XML profil, mert az SHA1 már egyezik\n"
 
-#: auth.c:921 cstp.c:317 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Nem sikerült a HTTPS kapcsolat megnyitása ehhez: %s\n"
@@ -316,458 +316,458 @@ msgstr "(Hiba történt a hiba leírása során!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "HIBA: Nem lehet előkészíteni a foglalatokat\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:276
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "KRITIKUS HIBA: A DTLS mestertitok nincs előkészítve. Kérjük ezt jelentse.\n"
 
-#: cstp.c:294
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Hiba a HTTPS CONNECT kérés létrehozásakor\n"
 
-#: cstp.c:310 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Hiba a HTTPS válasz lekérésekor\n"
 
-#: cstp.c:337
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "A VPN szolgáltatás nem érhető el; ok: %s\n"
 
-#: cstp.c:342
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Nem megfelelő HTTP CONNECT válasz érkezett: %s\n"
 
-#: cstp.c:349
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "CONNECT válasz érkezett: %s\n"
 
-#: cstp.c:377 cstp.c:385
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Nincs memória a kapcsolókhoz\n"
 
-#: cstp.c:394 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:413
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "Az X-DTLS-Session-ID nem 64 karakteres; értéke: „%s”\n"
 
-#: cstp.c:430
+#: cstp.c:433
 #, c-format
 msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
 msgstr "Az X-DTLS-Session-ID érvénytelen; értéke: „%s”\n"
 
-#: cstp.c:448
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Ismeretlen DTLS tartalomkódolás: %s\n"
 
-#: cstp.c:484
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Ismeretlen CSTP tartalomkódolás: %s\n"
 
-#: cstp.c:559
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Nem érkezett MTU. Megszakítás\n"
 
-#: cstp.c:567
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Nem érkezett IP-cím. Megszakítás\n"
 
-#: cstp.c:573
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "IPv6 beállítás érkezett, de a(z) %d MTU túl kicsi.\n"
 
-#: cstp.c:579
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Az újracsatlakozás eltérő örökölt IP-címet adott (%s != %s)\n"
 
-#: cstp.c:587
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "Az újracsatlakozás eltérő örökölt IP hálózati maszkot adott (%s != %s)\n"
 
-#: cstp.c:595
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Az újracsatlakozás eltérő IPv6-címet adott (%s != %s)\n"
 
-#: cstp.c:603
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Az újracsatlakozás eltérő IPv6 hálózati maszkot adott (%s != %s)\n"
 
-#: cstp.c:623
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP kapcsolódva. DPD %d, Keepalive %d\n"
 
-#: cstp.c:625
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP titkosító alkalmazáscsomag: %s\n"
 
-#: cstp.c:687
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Tömörítés beállítás sikertelen\n"
 
-#: cstp.c:704
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "A deflate puffer lefoglalása meghiúsult\n"
 
-#: cstp.c:762
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "inflate meghiúsult\n"
 
-#: cstp.c:785
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Az LZS kibontás meghiúsult: %s\n"
 
-#: cstp.c:798
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Az LZ4 kibontás meghiúsult\n"
 
-#: cstp.c:805
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Ismeretlen tömörítési típus: %d\n"
 
-#: cstp.c:810
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "%s / %d bájt tömörített adatcsomag érkezett (%d volt)\n"
 
-#: cstp.c:830
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "deflate meghiúsult: %d\n"
 
-#: cstp.c:900 dtls.c:239 dtls.c:698 esp.c:171 mainloop.c:67 oncp.c:933
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "A lefoglalás meghiúsult\n"
 
-#: cstp.c:911
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Rövid csomag érkezett (%d bájt)\n"
 
-#: cstp.c:924
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 "Váratlan csomaghossz. Az SSL_read visszatérési értéke %d, de a csomag\n"
 
-#: cstp.c:938
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "CSTP DPD kérés érkezett\n"
 
-#: cstp.c:944
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "CSTP DPD válasz érkezett\n"
 
-#: cstp.c:949
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "CSTP Keepalive érkezett\n"
 
-#: cstp.c:954 oncp.c:1022
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "%d bájt tömörítetlen adatcsomag érkezett\n"
 
-#: cstp.c:971
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Kiszolgáló leválasztás érkezett: %02x „%s”\n"
 
-#: cstp.c:974
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Kiszolgáló leválasztás érkezett\n"
 
-#: cstp.c:982
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Tömörített csomag érkezett !deflate módban\n"
 
-#: cstp.c:991
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "kiszolgáló megszakítás csomag érkezett\n"
 
-#: cstp.c:998
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Ismeretlen csomag: %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1041 oncp.c:1139
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "Az SSL túl kevés bájtot írt! %d volt a kérés, %d lett elküldve\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1069 oncp.c:1177
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP kulcsmegújítás esedékes\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1076 oncp.c:1184
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Újra kézfogás sikertelen, új alagút kísérlete\n"
 
-#: cstp.c:1087 oncp.c:1195
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "A CSTP halott csomópont felderítés halott csomópontot észlelt!\n"
 
-#: cstp.c:1091 oncp.c:1109 oncp.c:1199
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Újracsatlakozás sikertelen\n"
 
-#: cstp.c:1107 oncp.c:1215
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "CSTP DPD küldése\n"
 
-#: cstp.c:1119 oncp.c:1226
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "CSTP Keepalive küldése\n"
 
-#: cstp.c:1144
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "%d bájt tömörített adatcsomag küldése (%d volt)\n"
 
-#: cstp.c:1155 oncp.c:1251
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "%d bájt tömörítetlen adatcsomag küldése\n"
 
-#: cstp.c:1194
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "BYE csomag küldése: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Digest hitelesítési kísérlet a proxyra\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Digest hitelesítési kísérlet a kiszolgálóra: „%s”\n"
 
-#: dtls.c:75
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "DTLS csatlakozási kísérlet egy meglévő fd-vel\n"
 
-#: dtls.c:81
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Nincs DTLS cím\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:88
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "A kiszolgáló nem ajánlott DTLS titkosító lehetőséget\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:95
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Nincs DTLS proxy-n keresztüli csatlakozáskor\n"
 
-#: dtls.c:157
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS kapcsoló: %s : %s\n"
 
-#: dtls.c:198
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS előkészítve. DPD %d, Keepalive %d\n"
 
-#: dtls.c:224
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Új DTLS csatlakozási kísérlet\n"
 
-#: dtls.c:250
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Fogadott DTLS csomag 0x%02x / %d bájt\n"
 
-#: dtls.c:264
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "DTLS DPD kérés érkezett\n"
 
-#: dtls.c:270
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Nem sikerült a DPD válasz küldése. Leválasztás várható\n"
 
-#: dtls.c:274
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "DTLS DPD válasz érkezett\n"
 
-#: dtls.c:278
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "DTLS Keepalive érkezett\n"
 
-#: dtls.c:284
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 "Tömörített DTLS csomag érkezett, amikor a tömörítés nincs engedélyezve\n"
 
-#: dtls.c:292
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Ismeretlen DTLS csomagtípus: %02x, hossz: %d\n"
 
-#: dtls.c:314
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS kulcsmegújítás esedékes\n"
 
-#: dtls.c:321
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "DTLS újra kézfogás sikertelen, újracsatlakozás.\n"
 
-#: dtls.c:330
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "A DTLS halott csomópont felderítés halott csomópontot észlelt!\n"
 
-#: dtls.c:336
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "DTLS DPD küldése\n"
 
-#: dtls.c:341
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Nem sikerült a DPD kérés küldése. Leválasztás várható\n"
 
-#: dtls.c:354
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "DTLS Keepalive küldése\n"
 
-#: dtls.c:359
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Nem sikerült az életben tartás kérés küldése. Leválasztás várható\n"
 
-#: dtls.c:390 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Ismeretlen csomag (hossz: %d) érkezett: %02x %02x %02x %02x…\n"
 
-#: dtls.c:397
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr "TOS ez: %d, TOS utolsó: %d\n"
 
-#: dtls.c:401
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr "UDP setsockopt"
 
-#: dtls.c:432
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "A DTLS írási hibát kapott: %d. Visszatérés SSL-re\n"
 
-#: dtls.c:446
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "A DTLS írási hibát kapott: %s. Visszatérés SSL-re\n"
 
-#: dtls.c:461
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "%d bájt DTLS csomag küldése; a DTLS küldés visszatérése: %d\n"
 
-#: dtls.c:489
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "IPv4 MTU észlelés előkészítése (min=%d, max=%d)\n"
 
-#: dtls.c:509
+#: dtls.c:527
 msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 "Túl sok idő telt az MTU észlelési ciklusban; megbeszélt MTU feltételezése.\n"
 
-#: dtls.c:513
+#: dtls.c:531
 #, c-format
 msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 "Túl sok idő telt az MTU észlelési ciklusban; az MTU %d értékre beállítva.\n"
 
-#: dtls.c:522
+#: dtls.c:540
 #, c-format
 msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr "MTU DPD szonda küldése (%u bájt, min=%u, max=%u)\n"
 
-#: dtls.c:526
+#: dtls.c:544
 #, c-format
 msgid "Failed to send DPD request (%d %d)\n"
 msgstr "Nem sikerült a DPD kérés (%d %d) küldése\n"
 
-#: dtls.c:540 dtls.c:648
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr "Váratlan csomag (%.2x) érkezett az MTU észlelésnél; kihagyás.\n"
 
-#: dtls.c:552
+#: dtls.c:570
 #, c-format
 msgid "Timeout while waiting for DPD response; trying %d\n"
 msgstr "Időtúllépés a DPD válaszra várva; próbálkozás: %d\n"
 
-#: dtls.c:559 dtls.c:640
+#: dtls.c:577 dtls.c:658
 msgid "Timeout while waiting for DPD response; resending probe.\n"
 msgstr "Időtúllépés a DPD válaszra várva; szonda újraküldése.\n"
 
-#: dtls.c:566 dtls.c:667
+#: dtls.c:584 dtls.c:685
 #, c-format
 msgid "Failed to recv DPD request (%d)\n"
 msgstr "Nem sikerült a DPD kérés (%d) fogadása\n"
 
-#: dtls.c:571
+#: dtls.c:589
 #, c-format
 msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr "MTU DPD szonda fogadva (%u bájt / %u)\n"
 
-#: dtls.c:609
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "IPv6 MTU észlelés előkészítése\n"
 
-#: dtls.c:624
+#: dtls.c:642
 #, c-format
 msgid "Sending MTU DPD probe (%u bytes)\n"
 msgstr "MTU DPD szonda küldése (%u bájt)\n"
 
-#: dtls.c:628
+#: dtls.c:646
 #, c-format
 msgid "Failed to send DPD request (%d)\n"
 msgstr "Nem sikerült a DPD kérés (%d) küldése\n"
 
-#: dtls.c:653
+#: dtls.c:671
 #, c-format
 msgid "Received MTU DPD probe (%u bytes)\n"
 msgstr "MTU DPD szonda fogadva (%u bájt)\n"
 
-#: dtls.c:717
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "%d bájtos MTU észlelve (%d volt)\n"
 
-#: dtls.c:720
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Nincs változás az MTU-ban az észlelés után (%d volt)\n"
@@ -904,88 +904,98 @@ msgstr "Nem sikerült az ESP csomag küldése: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "%d bájtos ESP csomag elküldve\n"
 
-#: gnutls-dtls.c:164
+#: gnutls-dtls.c:168
 msgid "Failed to generate DTLS priority string\n"
 msgstr "Nem sikerült a DTLS prioritás karakterlánc előállítása\n"
 
-#: gnutls-dtls.c:173
+#: gnutls-dtls.c:177
 #, c-format
 msgid "Failed to initialize DTLS: %s\n"
 msgstr "A DTLS előkészítése sikertelen: %s\n"
 
-#: gnutls-dtls.c:182
+#: gnutls-dtls.c:186
 #, c-format
 msgid "Failed to set DTLS priority: '%s': %s\n"
 msgstr "Nem sikerült a DTLS prioritás beállítása: „%s”: %s\n"
 
-#: gnutls-dtls.c:194
+#: gnutls-dtls.c:198
 #, c-format
 msgid "Failed to allocate credentials: %s\n"
 msgstr "Nem sikerült a hitelesítő adatok lefoglalása: %s\n"
 
-#: gnutls-dtls.c:207
+#: gnutls-dtls.c:211
 #, c-format
 msgid "Failed to generate DTLS key: %s\n"
 msgstr "Nem sikerült a DTLS kulcs előállítása: %s\n"
 
-#: gnutls-dtls.c:221
+#: gnutls-dtls.c:225
 #, c-format
 msgid "Failed to set DTLS key: %s\n"
 msgstr "Nem sikerült a DTLS kulcs beállítása: %s\n"
 
-#: gnutls-dtls.c:229
+#: gnutls-dtls.c:233
 #, c-format
 msgid "Failed to set DTLS PSK credentials: %s\n"
 msgstr "Nem sikerült a DTLS PSK hitelesítő adatok beállítása: %s\n"
 
-#: gnutls-dtls.c:262
+#: gnutls-dtls.c:266
 #, c-format
 msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
 msgstr "Ismeretlen DTLS paraméterek a kért „%s” CipherSuite esetén\n"
 
-#: gnutls-dtls.c:277
+#: gnutls-dtls.c:281
 #, c-format
 msgid "Failed to set DTLS priority: %s\n"
 msgstr "Nem sikerült a DTLS prioritás beállítása: %s\n"
 
-#: gnutls-dtls.c:298
+#: gnutls-dtls.c:302
 #, c-format
 msgid "Failed to set DTLS session parameters: %s\n"
 msgstr "Nem sikerült a DTLS munkamenet paraméterek beállítása: %s\n"
 
-#: gnutls-dtls.c:321 openssl-dtls.c:404
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
 msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
 msgstr ""
 "A DTLS munkamenet folytatása nem sikerült; lehetséges beékelődéses támadás. "
 "A DTLS letiltása.\n"
 
-#: gnutls-dtls.c:334
+#: gnutls-dtls.c:363
 #, c-format
 msgid "Failed to set DTLS MTU: %s\n"
 msgstr "Nem sikerült a DTLS MTU beállítása: %s\n"
 
-#: gnutls-dtls.c:352
+#: gnutls-dtls.c:382
 #, c-format
 msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
 msgstr ""
 "DTLS kapcsolat kiépítve (GnuTLS használatával). Titkosító alkalmazáscsomag: "
 "%s.\n"
 
-#: gnutls-dtls.c:358 openssl-dtls.c:421
+#: gnutls-dtls.c:388 openssl-dtls.c:522
 #, c-format
 msgid "DTLS connection compression using %s.\n"
 msgstr "DTLS kapcsolattömörítés %s használatával.\n"
 
-#: gnutls-dtls.c:373 openssl-dtls.c:502 openssl-dtls.c:506
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
 msgid "DTLS handshake timed out\n"
 msgstr "A DTLS kézfogás túllépte az időkorlátot\n"
 
-#: gnutls-dtls.c:376
+#: gnutls-dtls.c:406
 #, c-format
 msgid "DTLS handshake failed: %s\n"
 msgstr "A DTLS kézfogás meghiúsult: %s\n"
 
-#: gnutls-dtls.c:380
+#: gnutls-dtls.c:410
 msgid "(Is a firewall preventing you from sending UDP packets?)\n"
 msgstr "(Egy tűzfal akadályozza az UDP csomagok küldését?)\n"
 
@@ -1028,7 +1038,7 @@ msgstr "Az ESP csomag kezdeti értékének (IV) előállítása sikertelen: %s\n
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Az ESP csomag titkosítása sikertelen: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL írás megszakítva\n"
 
@@ -1037,7 +1047,7 @@ msgstr "SSL írás megszakítva\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Nem sikerült írni az SSL foglalatba: %s\n"
 
-#: gnutls.c:176 gnutls.c:268 openssl.c:191 openssl.c:258
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL olvasás megszakítva\n"
 
@@ -1067,15 +1077,15 @@ msgstr "SSL küldés sikertelen: %s\n"
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Nem sikerült kinyerni a tanúsítvány lejárati idejét\n"
 
-#: gnutls.c:351 openssl.c:1611
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "A kliens tanúsítvány érvényessége lejárt"
 
-#: gnutls.c:353 openssl.c:1616
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "A kliens tanúsítvány hamarosan lejár"
 
-#: gnutls.c:402 openssl.c:786
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
@@ -1105,11 +1115,11 @@ msgstr "Nem sikerült a tanúsítvány beolvasása a memóriába: %s\n"
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Nem sikerült beállítani a PKCS#12 adatszerkezetet: %s\n"
 
-#: gnutls.c:493 openssl.c:555
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Nem sikerült visszafejteni a PKCS#12 tanúsítvány fájlt\n"
 
-#: gnutls.c:497 openssl.c:558
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "PKCS#12 jelmondat megadása:"
 
@@ -1184,7 +1194,7 @@ msgstr "Nem sikerült visszafejteni a PEM kulcsot: %s\n"
 msgid "Decrypting PEM key failed\n"
 msgstr "A PEM kulcs visszafejtése nem sikerült\n"
 
-#: gnutls.c:996 gnutls.c:1530 openssl.c:479
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "PEM jelmondat megadása:"
 
@@ -1216,7 +1226,7 @@ msgstr "Hiba a tanúsítvány betöltésekor a PKCS#11 fájlból: %s\n"
 msgid "Error loading system certificate: %s\n"
 msgstr "Hiba a rendszertanúsítvány betöltésekor: %s\n"
 
-#: gnutls.c:1159 openssl.c:842
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "A következő tanúsítványfájl használata: %s\n"
@@ -1280,7 +1290,7 @@ msgstr ""
 msgid "Using private key file %s\n"
 msgstr "A következő személyes kulcs fájl használata: %s\n"
 
-#: gnutls.c:1451 openssl.c:666
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Az OpenConnect ezen verziója TPM támogatás nélkül készült\n"
 
@@ -1298,7 +1308,7 @@ msgstr "Nem sikerült betölteni a PKCS#1 személyes kulcsot: %s\n"
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Nem sikerült betölteni a személyes kulcsot PKCS#8-ként: %s\n"
 
-#: gnutls.c:1526 gnutls.c:1559 openssl.c:1013 openssl.c:1023
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Nem sikerült visszafejteni a PKCS#8 tanúsítvány fájlt\n"
 
@@ -1307,7 +1317,7 @@ msgstr "Nem sikerült visszafejteni a PKCS#8 tanúsítvány fájlt\n"
 msgid "Failed to determine type of private key %s\n"
 msgstr "Nem sikerült meghatározni a személyes kulcs típusát: %s\n"
 
-#: gnutls.c:1563 openssl.c:1019
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "PKCS#8 jelmondat megadása:"
 
@@ -1330,7 +1340,7 @@ msgstr "Hiba az aláírás hitelesítésekor a tanúsítvány ellenében: %s\n"
 msgid "No SSL certificate found to match private key\n"
 msgstr "Nem található SSL tanúsítvány a személyes kulcs egyezésére\n"
 
-#: gnutls.c:1675 openssl.c:581 openssl.c:724
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "A következő klienstanúsítvány használata: „%s”\n"
@@ -1374,164 +1384,164 @@ msgstr "Támogatott CA hozzáadása: „%s”\n"
 msgid "Setting certificate failed: %s\n"
 msgstr "A tanúsítvány beállítása nem sikerült: %s\n"
 
-#: gnutls.c:2074
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "A kiszolgáló nem mutatott be tanúsítványt\n"
 
-#: gnutls.c:2082
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 "Hiba a kiszolgáló tanúsítványának újbóli kézfogáskor történő "
 "összehasonlításakor: %s\n"
 
-#: gnutls.c:2087 openssl.c:1534
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 "A kiszolgáló különböző tanúsítványt mutatott be az újbóli kézfogáskor\n"
 
-#: gnutls.c:2092 openssl.c:1537
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "A kiszolgáló azonos tanúsítványt mutatott be az újbóli kézfogáskor\n"
 
-#: gnutls.c:2098
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Hiba az X509 tanúsítvány szerkezet előkészítésekor\n"
 
-#: gnutls.c:2104
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Hiba a kiszolgáló tanúsítványának importálásakor\n"
 
-#: gnutls.c:2113 main.c:1705
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Nem sikerült kiszámolni a kiszolgáló tanúsítványának hash értékét\n"
 
-#: gnutls.c:2118
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Hiba a kiszolgáló tanúsítványállapotának ellenőrzésekor\n"
 
-#: gnutls.c:2123
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "tanúsítvány visszavonva"
 
-#: gnutls.c:2125
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "aláíró nem található"
 
-#: gnutls.c:2127
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "az aláíró nem hitelesítésszolgáltatói tanúsítvány"
 
-#: gnutls.c:2129
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "nem biztonságos algoritmus"
 
-#: gnutls.c:2131
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "a tanúsítvány még nincs aktiválva"
 
-#: gnutls.c:2133
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "a tanúsítvány lejárt"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2138
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "az aláírás ellenőrzése sikertelen"
 
-#: gnutls.c:2187 openssl.c:1418 openssl.c:1570
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "a tanúsítvány nem egyezik a gépnévvel"
 
-#: gnutls.c:2192 openssl.c:1417 openssl.c:1576
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "A kiszolgáló tanúsítványának ellenőrzése meghiúsult: %s\n"
 
-#: gnutls.c:2264
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 "Nem sikerült memóriát lefoglalni a hitelesítés-szolgáltató fájl "
 "tanúsítványokhoz\n"
 
-#: gnutls.c:2285
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 "Nem sikerült a tanúsítványok olvasása a hitelesítés-szolgáltató fájlból: "
 "„%s”\n"
 
-#: gnutls.c:2301
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Nem sikerült megnyitni a(z) „%s” CA fájlt: %s\n"
 
-#: gnutls.c:2314 openssl.c:1698
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "A tanúsítvány betöltése nem sikerült. Megszakítás.\n"
 
-#: gnutls.c:2385
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "A TLS prioritás szöveg („%s”) beállítása sikertelen: %s\n"
 
-#: gnutls.c:2397 openssl.c:1815
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL egyeztetés ezzel: %s\n"
 
-#: gnutls.c:2444 openssl.c:1841
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Az SSL kapcsolat megszakítva\n"
 
-#: gnutls.c:2451
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Az SSL kapcsolat meghiúsult: %s\n"
 
-#: gnutls.c:2460
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Nem végzetes GnuTLS visszatérés a kézfogás közben: %s\n"
 
-#: gnutls.c:2466 openssl.c:1858
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Kapcsolódva HTTPS-hez ezen: %s\n"
 
-#: gnutls.c:2469
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "SSL újraegyeztetés ezen: %s\n"
 
-#: gnutls.c:2776 openssl-pkcs11.c:199
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN-kód szükséges ehhez: %s"
 
-#: gnutls.c:2780 openssl-pkcs11.c:202
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Hibás PIN-kód"
 
-#: gnutls.c:2783
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Ez az utolsó próbálkozás a zárolás előtt!"
 
-#: gnutls.c:2785
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Már csak néhány próbálkozás van a zárolás előtt!"
 
-#: gnutls.c:2790 openssl-pkcs11.c:206
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Adja meg a PIN-kódot:"
 
-#: gnutls.c:2921 openssl.c:1986
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Nem támogatott OATH HMAC algoritmus\n"
 
-#: gnutls.c:2930
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Nem sikerült az OATH HMAC kiszámítása: %s\n"
@@ -1725,7 +1735,7 @@ msgstr "Alap HTML hitelesítési kísérlet a proxyra\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Alap HTML hitelesítési kísérlet a kiszolgálóra: „%s”\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Az OpenConnect ezen verziója GSSAPI támogatás nélkül készült\n"
 
@@ -1746,238 +1756,238 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Nincs több kipróbálható hitelesítési eljárás\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Nincs memória a sütik lefoglalásához\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Nem sikerült feldolgozni a következő HTTP választ: „%s”\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "HTTP válasz érkezett: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Hiba a HTTP válasz feldolgozásakor\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ismeretlen HTTP válasz sor mellőzése: „%s”\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Érvénytelen sütit ajánlottak: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Az SSL tanúsítvány hitelesítése nem sikerült\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "A választörzsnek negatív mérete van (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Ismeretlen átviteli kódolás: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP törzs %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Hiba a HTTP válasz törzsének olvasásakor\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Hiba a fejléc darabjának lekérésekor\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Hiba a HTTP válasz törzsének lekérésekor\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Hiba a darabolt dekódolásban. „” várt, „%s” érkezett"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Nem fogadható HTTP 1.0 törzs a kapcsolat lezárása nélkül\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Nem sikerült feldolgozni az átirányított „%s” URL-t: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Nem követhető az átirányítás nem HTTPS URL-re: „%s”\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Új útvonal lefoglalása a relatív átirányításhoz nem sikerült: %s\n"
 
-#: http.c:929 oncp.c:592 oncp.c:629
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Váratlan %d eredmény a kiszolgálótól\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "kérés megadva"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "általános hiba"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "a kapcsolatot a szabálykészlet nem engedélyezi"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "a hálózat elérhetetlen"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "a gép elérhetetlen"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "a célgép visszautasította a kapcsolatot"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL lejárt"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "a parancs nem támogatott / protokollhiba"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "a címtípus nem támogatott"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "A SOCKS kiszolgáló felhasználónevet/jelszót kért, de nekünk nincs olyan\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "A SOCKS hitelesítés felhasználónevének és jelszavának < 255 bájtnak kell "
 "lennie\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Hiba a SOCKS proxy hitelesítési kérésének írásakor: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Hiba a SOCKS proxy hitelesítési válaszának olvasásakor: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Váratlan hitelesítési válasz a következő SOCKS proxy-tól: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Hitelesítés a SOCKS kiszolgálóra jelszó használatával\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "A jelszavas hitelesítés a SOCKS kiszolgálóra nem sikerült\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "A SOCKS kiszolgáló GSSAPI hitelesítést kért\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "A SOCKS kiszolgáló jelszavas hitelesítést kért\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "A SOCKS kiszolgálóhoz hitelesítés szükséges\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "A SOCKS kiszolgáló ismeretlen %02x hitelesítéstípust kért\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "SOCKS proxy csatlakozási kérés ide: %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Hiba a SOCKS proxy csatlakozási kérésének írásakor: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Hiba a SOCKS proxy csatlakozási válaszának olvasásakor: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Váratlan csatlakozási válasz a következő SOCKS proxy-tól: %02x %02x…\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS proxy hiba %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS proxy hiba %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Váratlan %02x címtípus a SOCKS proxy csatlakozási válaszában\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "HTTP proxy csatlakozási kérés ide: %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "A proxy kérés küldése nem sikerült: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "A proxy CSATLAKOZÁS kérés nem sikerült: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Ismeretlen proxy típus: „%s”\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Csak http vagy socks(5) proxyk támogatottak\n"
 
@@ -1990,16 +2000,28 @@ msgstr "Ismeretlen VPN protokoll: „%s”\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "A Cisco DTLS támogatás nélküli SSL könyvtárral szemben készítve\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Nem sikerült a kiszolgáló URL feldolgozása: „%s”\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Csak https:// engedélyezett a kiszolgáló URL-hez\n"
 
-#: library.c:1019
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Nincs űrlapkezelő, nem lehet hitelesíteni.\n"
 
@@ -2717,16 +2739,16 @@ msgstr "A tun parancsfájl beállítása nem sikerült\n"
 msgid "Set up tun device failed\n"
 msgstr "A tun eszköz beállítása nem sikerült\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "A hívó szüneteltette a kapcsolatot\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Nincs tennivalója; alvás %d ms-ra…\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "WaitForMultipleObjects sikertelen: %s\n"
@@ -2795,7 +2817,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "OATH TOTP tokenkód előállítása\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "OATH HOTP tokenkód előállítása\n"
 
@@ -3056,54 +3078,59 @@ msgstr "Kimenő csomag:\n"
 msgid "Sent ESP enable control packet\n"
 msgstr "ESP engedélyezési vezérlőcsomag elküldve\n"
 
-#: openconnect-internal.h:1065 openconnect-internal.h:1073
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 "HIBA: %s() érvénytelen UTF-8 értékkel lett meghívva a(z) „%s” argumentumnál\n"
 
-#: openssl-dtls.c:134
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
 #, c-format
 msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
 msgstr "Nem sikerült az SSL_SESSION ASN.1 létrehozása az OpenSSL-nél: %s\n"
 
-#: openssl-dtls.c:145
+#: openssl-dtls.c:227
 msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
 msgstr "Az OpenSSL nem tudta feldolgozni: SSL_SESSION ASN.1\n"
 
-#: openssl-dtls.c:159
+#: openssl-dtls.c:241
 msgid "Initialise DTLSv1 session failed\n"
 msgstr "A DTLSv1 munkamenet előkészítése nem sikerült\n"
 
-#: openssl-dtls.c:188
+#: openssl-dtls.c:270
 msgid "PSK callback\n"
 msgstr "PSK visszahívás\n"
 
-#: openssl-dtls.c:205
+#: openssl-dtls.c:287
 msgid "Failed to create app-identity extension for OpenSSL\n"
 msgstr "Nem sikerült az app-identity bővítmény létrehozása az OpenSSL-hez\n"
 
-#: openssl-dtls.c:269
+#: openssl-dtls.c:352
 msgid "Initialise DTLSv1 CTX failed\n"
 msgstr "A DTLSv1 CTX előkészítése nem sikerült\n"
 
-#: openssl-dtls.c:282
+#: openssl-dtls.c:365
 msgid "Set DTLS CTX version failed\n"
 msgstr "A DTLS CTX verzió beállítása sikertelen\n"
 
-#: openssl-dtls.c:299
+#: openssl-dtls.c:382
 msgid "Failed to generate DTLS key\n"
 msgstr "Nem sikerült a DTLS kulcs előállítása\n"
 
-#: openssl-dtls.c:319
+#: openssl-dtls.c:402
 msgid "Set DTLS cipher list failed\n"
 msgstr "A DTLS titkosítólista beállítása nem sikerült\n"
 
-#: openssl-dtls.c:333
+#: openssl-dtls.c:417
 msgid "Not precisely one DTLS cipher\n"
 msgstr "Nem pontosan egy DTLS titkosító\n"
 
-#: openssl-dtls.c:366
+#: openssl-dtls.c:439
 #, c-format
 msgid ""
 "SSL_set_session() failed with old protocol version 0x%x\n"
@@ -3116,20 +3143,20 @@ msgstr ""
 "Nézze meg a http://rt.openssl.org/Ticket/Display.html?id=1751 oldalt\n"
 "Használja a --no-dtls parancssori kapcsolót ezen üzenet elkerüléséhez\n"
 
-#: openssl-dtls.c:415
+#: openssl-dtls.c:516
 #, c-format
 msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
 msgstr ""
 "DTLS kapcsolat kiépítve (OpenSSL használatával). Titkosító alkalmazáscsomag: "
 "%s.\n"
 
-#: openssl-dtls.c:452
+#: openssl-dtls.c:553
 msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
 msgstr ""
 "Az OpenSSL verziója régebbi, mint amellyel szemben kiépítette, így a DTLS "
 "meghiúsulhat!"
 
-#: openssl-dtls.c:503
+#: openssl-dtls.c:604
 msgid ""
 "This is probably because your OpenSSL is broken\n"
 "See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
@@ -3137,7 +3164,7 @@ msgstr ""
 "Ez valószínűleg azért lehet, mert az OpenSSL törött\n"
 "Nézze meg a http://rt.openssl.org/Ticket/Display.html?id=2984 oldalt\n"
 
-#: openssl-dtls.c:510
+#: openssl-dtls.c:611
 #, c-format
 msgid "DTLS handshake failed: %d\n"
 msgstr "A DTLS kézfogás meghiúsult: %d\n"
@@ -3242,7 +3269,7 @@ msgstr "Nem sikerült megtalálni a(z) „%s” PKCS#11 tanúsítványt\n"
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "A tanúsítvány X.509 tartalmát nem kérte le a libp11\n"
 
-#: openssl-pkcs11.c:412 openssl.c:728
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Nem sikerült a tanúsítvány telepítése az OpenSSL környezetben\n"
 
@@ -3294,263 +3321,263 @@ msgstr "A kulcs hozzáadása nem sikerült a PKCS#11-ből\n"
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Az OpenConnect ezen verziója PKCS#11 támogatás nélkül készült\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Nem sikerült írni az SSL foglalatba\n"
 
-#: openssl.c:184 openssl.c:250
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Nem sikerült olvasni az SSL foglalatból\n"
 
-#: openssl.c:279
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "SSL olvasási hiba: %d (a kiszolgáló valószínűleg lezárta a kapcsolatot); "
 "újracsatlakozás.\n"
 
-#: openssl.c:304
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write sikertelen: %d\n"
 
-#: openssl.c:378
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Kezeletlen SSL UI kéréstípus: %d\n"
 
-#: openssl.c:486
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "A PEM jelszó túl hosszú (%d >= %d)\n"
 
-#: openssl.c:519
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "További tanúsítvány innen: %s: „%s”\n"
 
-#: openssl.c:569
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "A PKCS#12 feldolgozása nem sikerült (lásd a fenti hibákat)\n"
 
-#: openssl.c:584
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "A PKCS#12 nem tartalmazott tanúsítványt!\n"
 
-#: openssl.c:593
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "A PKCS#12 nem tartalmazott személyes kulcsot!\n"
 
-#: openssl.c:598
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:616
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Nem sikerült betölteni a TPM motort.\n"
 
-#: openssl.c:622
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Nem sikerült előkészíteni a TPM motort\n"
 
-#: openssl.c:632
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Nem sikerült beállítani a TPM SRK jelszót\n"
 
-#: openssl.c:646
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Nem sikerült betölteni a TPM személyes kulcsot\n"
 
-#: openssl.c:652
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "A kulcs hozzáadása nem sikerült a TPM-ből\n"
 
-#: openssl.c:702 openssl.c:850
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Nem sikerült a(z) %s tanúsítványfájl megnyitása: %s\n"
 
-#: openssl.c:712
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "A tanúsítvány betöltése nem sikerült\n"
 
-#: openssl.c:750
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Nem sikerült minden támogatott tanúsítvány feldolgozása. Azért megpróbálom…\n"
 
-#: openssl.c:763
+#: openssl.c:776
 msgid "PEM file"
 msgstr "PEM fájl"
 
-#: openssl.c:792
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Nem sikerült a BIO létrehozása a következő kulcstartó elemnél: „%s”\n"
 
-#: openssl.c:817
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "A személyes kulcs betöltése nem sikerült (rossz jelmondat?)\n"
 
-#: openssl.c:823
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "A személyes kulcs betöltése nem sikerült (lásd a fenti hibákat)\n"
 
-#: openssl.c:873
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Nem sikerült betölteni az X509 tanúsítványt a kulcstartóról\n"
 
-#: openssl.c:879
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Nem sikerült az X509 tanúsítvány használata a kulcstartóról\n"
 
-#: openssl.c:911
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Nem sikerült a személyes kulcs használata a kulcstartóról\n"
 
-#: openssl.c:927
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "A(z) %s személyes kulcsfájl megnyitása nem sikerült: %s\n"
 
-#: openssl.c:947 openssl.c:962 openssl.c:983 openssl.c:1049
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "A személyes kulcs betöltése nem sikerült\n"
 
-#: openssl.c:1043
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr "A PKCS#8 átalakítása OpenSSL EVP_PKEY kulcsra sikertelen\n"
 
-#: openssl.c:1060
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Nem sikerült azonosítani a személyes kulcs típusát ebben: „%s”\n"
 
-#: openssl.c:1222
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Egyező DNS altname: „%s”\n"
 
-#: openssl.c:1229
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Nincs egyezés a következő altname értékre: „%s”\n"
 
-#: openssl.c:1243
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "A tanúsítványnak GEN_IPADD altname értéke van hamis hosszal: %d\n"
 
-#: openssl.c:1254 openssl.c:1400
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Egyező %s cím: „%s”\n"
 
-#: openssl.c:1261
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Nincs egyezés a(z) %s címmel: „%s”\n"
 
-#: openssl.c:1303
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "A(z) „%s” URI nem üres útvonallal rendelkezik; mellőzés\n"
 
-#: openssl.c:1308
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Egyező URI: „%s”\n"
 
-#: openssl.c:1319
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Nincs egyezés a következő URI-ra: „%s”\n"
 
-#: openssl.c:1334
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 "Nincs altname érték a következőre illeszkedő csomópont tanúsítványában: "
 "„%s”\n"
 
-#: openssl.c:1342
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Nincs tárgynév a csomópont tanúsítványában!\n"
 
-#: openssl.c:1362
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Nem sikerült a tárgynév feldolgozása a csomópont tanúsítványában\n"
 
-#: openssl.c:1369
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "A csomópont tanúsítvány tárgya nem megfelelő („%s” != „%s”)\n"
 
-#: openssl.c:1374 openssl.c:1408
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Egyező csomópont tanúsítvány tárgynév: „%s”\n"
 
-#: openssl.c:1470
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "További tanúsítvány a hitelesítés-szolgáltató fájlból: „%s”\n"
 
-#: openssl.c:1608
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Hiba a kliens tanúsítvány notAfter mezőjében\n"
 
-#: openssl.c:1621
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<hiba>"
 
-#: openssl.c:1674
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr "TLSv1 CTX létrehozása sikertelen\n"
 
-#: openssl.c:1693
+#: openssl.c:1705
 msgid "SSL certificate and key do not match\n"
 msgstr "Az SSL tanúsítvány és a kulcs nem egyezik\n"
 
-#: openssl.c:1738
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Nem sikerült a tanúsítványok olvasása a CA fájlból: „%s”\n"
 
-#: openssl.c:1771
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Nem sikerült megnyitni a CA fájlt: „%s”\n"
 
-#: openssl.c:1831
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Az SSL kapcsolat meghiúsult\n"
 
-#: openssl.c:1992
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Nem sikerült kiszámítani a OATH HMAC kódot\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Rossz felosztott felvétel eldobása: „%s”\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Rossz felosztott kizárás eldobása: „%s”\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Nem sikerült a(z) „%s” parancsfájl elindítása ehhez: %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "A(z) „%s” parancsfájl nem megfelelő módon lépett ki (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "A(z) „%s” parancsfájl a következő hibakóddal tért vissza: %d\n"
@@ -4254,18 +4281,3 @@ msgstr "kiszámítás parancs"
 #: yubikey.c:608
 msgid "Unrecognised response from Yubikey when generating tokencode\n"
 msgstr "Azonosítatlan válasz a Yubikey-től a tokenkód előállításakor\n"
-
-#~ msgid "using OpenSSL"
-#~ msgstr "OpenSSL használata"
-
-#~ msgid "Failed to recv DPD request (%d): %s\n"
-#~ msgstr "Nem sikerült a DPD kérés (%d) fogadása: %s\n"
-
-#~ msgid "Failed to send DPD request (%d): %s\n"
-#~ msgstr "Nem sikerült a DPD kérés (%d) küldése: %s\n"
-
-#~ msgid "Too long time in MTU detect loop; bailing out.\n"
-#~ msgstr "Túl sok idő telt az MTU észlelési ciklusban; kiugrás.\n"
-
-#~ msgid "SSL operation cancelled\n"
-#~ msgstr "Az SSL művelet megszakítva\n"
diff --git a/po/id.po b/po/id.po
index 18807108..5cf7ffcd 100644
--- a/po/id.po
+++ b/po/id.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-11-15 08:31+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Indonesian (http://www.transifex.com/projects/p/meego/"
@@ -175,7 +175,7 @@ msgstr "Meminta sandi tapi '--no-passwd' ditata\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Tak mengunduh profil XML karena SHA1 telah cocok\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Gagal membuka koneksi HTTPS ke %s\n"
@@ -312,555 +312,486 @@ msgstr "(Galat ketika menjelaskan kesalahan!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "GALAT: Tak bisa menginisialisasi soket\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "GALAT KRITIS: Rahasia induk DTLS tak terinisialisasi. Harap laporkan ini.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Galat saat membuat permintaan HTTPS CONNECT\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Galat saat mengambil respon HTTPS\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Layanan VPN tak tersedia; alasan: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Mendapat respon HTTP CONNECT yang tak sepantasnya: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Mendapat respon CONNECT: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Tak ada memori bagi opsi\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<tak dibunyikan>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID buka 64 karacter; yaitu: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "DTLS-Content-Encoding %s tak dikenal\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "CSTP-Content-Encoding %s tak dikenal\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "MTU tak diterima. Menggugurkan\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Alamat IP tak diterima. Menggugurkan\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Konfigurasi IPv6 diterima tapi MTU %d terlalu kecil.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Menyambung ulang memberi alamat IP Legacy yang berbeda (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Menyambung ulang memberi netmask IP Legacy yang berbeda (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Menyambung ulang memberi alamat IPv6 yang berbeda (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Menyambung ulang memberi netmask IPv6 yang berbeda (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP tersambung. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP Ciphersuite: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Penyiapan kompresi gagal\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Alokasi penyangga deflate gagal\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "inflate gagal\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Dekompresi LZS gagal: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Dekompresi LZ4 gagal\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Tipe kompresi %d tak dikenal\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Menerima %s paket data terkompresi %d byte (sebelumnya %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "deflate gagal %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Alokasi gagal\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Diterima paket pendek (%d byte)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Panjang paket tak diharapkan. SSL_read mengembalikan %d tapi paket\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Mendapat permintaan CSTP DPD\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Mendapat respon CSTP DPD\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Mendapat CSTP Keepalive\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Menerima paket data tak terkompresi %d byte\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Menerima pemutusan server: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Menerima pemutusan server\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Paket terkompresi diterima dalam mode !deflate\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "menerima paket terminasi server\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Paket tak dikenal %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL menulis terlalu sedikit byte! Minta %d, dikirimi %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Kunci ulang CSTP jatuh tempo\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Jabat tangan ulang gagal; mencoba tunnel baru\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "Pendeteksi Pasangan Mati CSTP mendeteksi pasangan yang mati!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Sambung ulang gagal\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Kirim DPD CSTP\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Kirim Keepalive CSTP\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Mengirim paket data terkompresi %d byte (sebelumnya %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Mengirim paket data tak terkompresi %d byte\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Kirim paket BYE: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Mencoba otentikasi digest ke proksi\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Mencoba otentikasi Digest ke server '%s'\n"
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr "Gagal membuat SSL_SESSION ASN.1 untuk OpenSSL: %s\n"
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr "OpenSSL gagal mengurai SSL_SESSION ASN.1\n"
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Inisialisasi sesi DTLSv1 gagal\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Inisialisasi DTLSv1 CTX gagal\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Penataan daftar cipher DTLS gagal\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Bukan secara tepat satu cipher DTLS\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() gagal dengan versi protokol lama 0x%x\n"
-"Apakah Anda memakai versi OpenSSL yang lebih tua dari 0.9.8m?\n"
-"Lihat http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Pakai opsi baris perintah --no-dtls untuk menghindari pesan ini\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "Terjalin koneksi DTLS (memakai OpenSSL). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr "Kompresi koneksi DTLS memakai %s.\n"
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"OpenSSL Anda lebih tua daripada yang Anda pakai untuk membangun, sehingga "
-"DTLS mungkin gagal!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "Habis waktu jabat tangan DTLS\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Ini mungkin karena OpenSSL Anda rusak\n"
-"Lihat http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "Jabat tangan DTLS gagal: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Parameter DTLS tak dikenal bagi CipherSuite '%s' yang diminta\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Gagal menata prioritas DTLS: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Gagal menata parameter sesi DTLS: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Gagal menata MTU DTLS: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Terjalink koneksi DTLS (memakai GnuTLS). Ciphersuite %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Jabat tangan DTLS gagal: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(Apakah sebuah firewall mencegah Anda mengirim paket-paket UDP?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "Koneksi DTLS dicoba dengan fd yang ada\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Tak ada alamat DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Server tak menawarkan opsi cipher DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Tak ada DTLS ketika tersambung lewat proksi\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Opsi DTLS %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS diinisialisasi. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Mencoba koneksi DTLS baru\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Diterima paket DTLS 0x%02x dari %d byte\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Mendapat permintaan DTLS DPD\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Gagal mengirim respon DPD. Mengharapkan pemutusan koneksi\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Mendapat respon DTLS DPD\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Mendapat DTLS Keepalive\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Paket DTLS terkompresi diterima ketika kompresi tidak difungsikan\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Tipe paket DTLS tak dikenal %02x, len %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Kunci ulang DTLS jatuh tempo\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Jabat tangan ulang DTLS gagal; menyambung ulang.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "Pendeteksi Pasangan Mati DTLS mendeteksi pasangan yang mati!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Kirim DPD DTLS\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Gagal mengirim permintaan DPD. Mengharapkan pemutusan koneksi\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Kirim Keepalive DTLS\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Gagal mengirim permintaan keepalive. Mengharapkan pemutusan koneksi\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Paket tak dikenal (len %d) diterima: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS mendapat galat tulis %d. Berpindah ke SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS mendapat galat tulis: %s. Berpindah ke SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Dikirim paket DTLS %d byte; DTLS send mengembalikan %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
-msgstr "Operasi SSL dibatalkan\n"
-
-#: dtls.c:1169
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Mengawali deteksi MTU IPv4 (min=%d, maks=%d)\n"
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
-msgstr "Terlalu lama dalam loop deteksi MTU; menarik diri.\n"
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:531
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
-msgstr "Gagal mengirim permintaan DPD (%d): %s\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
+msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
+msgstr ""
+
+#: dtls.c:544
+#, c-format
+msgid "Failed to send DPD request (%d %d)\n"
+msgstr ""
+
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 "Menerima paket yang tak diharapkan (%.2x) dalam deteksi MTU; melewati.\n"
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
-msgstr "Gagal menerima permintaan DPD (%d): %s\n"
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Mengawali deteksi MTU IPv6\n"
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "MTU terdeteksi %d byte (sebelumnya %d)\n"
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Tidak ada perubahan MTU setelah deteksi (sebelumnya %d)\n"
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr "Menerima paket ESP yang diharapkan dengan seq %u\n"
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Membuang paket ESP kuno dengan seq %u (diharapkan %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr ""
+"Menerima paket ESP yang lebih lambat dari yang diharapkan dengan seq %u "
+"(diharapkan %<PRIu64>)\n"
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr ""
-"Menerima paket ESP diluar urutan dengan seq %u (diharapkan %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Membuang paket ESP kuno dengan seq %u (diharapkan %<PRIu64>)\n"
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr "Membuang paket ESP yang terkirim ulang dengan seq %u\n"
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
-"Menerima paket ESP yang lebih lambat dari yang diharapkan dengan seq %u "
-"(diharapkan %<PRIu64>)\n"
+"Menerima paket ESP diluar urutan dengan seq %u (diharapkan %<PRIu64>)\n"
 
 #: esp.c:68
 #, c-format
@@ -961,6 +892,97 @@ msgstr "Gagal mengirim paket ESP: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Mengirim paket ESP %d byte\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Parameter DTLS tak dikenal bagi CipherSuite '%s' yang diminta\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Gagal menata prioritas DTLS: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Gagal menata parameter sesi DTLS: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Gagal menata MTU DTLS: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Terjalink koneksi DTLS (memakai GnuTLS). Ciphersuite %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr "Kompresi koneksi DTLS memakai %s.\n"
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "Habis waktu jabat tangan DTLS\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Jabat tangan DTLS gagal: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(Apakah sebuah firewall mencegah Anda mengirim paket-paket UDP?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -981,7 +1003,7 @@ msgstr "Gagal membuat kunci acak bagi ESP: %s\n"
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr "Gagal menghitung HMAC bagi paket ESP: %s\n"
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr "Menerima paket ESP dengan HMAC yang tak valid\n"
 
@@ -1000,7 +1022,7 @@ msgstr "Gagal membuat IV paket ESP: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Gagal mengenkripsi paket ESP: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL write dibatalkan\n"
 
@@ -1009,487 +1031,491 @@ msgstr "SSL write dibatalkan\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Gagal menulis ke soket SSL: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL read dibatalkan\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "Soket SSL ditutup tak secara bersih\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Gagal baca dari soket SSL: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Galat SSL read: %s; menyambung ulang.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "SSL send gagal: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Tak bisa mengekstrak waktu kedaluarsa dari sertifikat\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Sertifikat klien telah kedaluarsa pada"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Sertifikat klien segera kedaluarsa pada"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Gagal memuat butir '%s' dari penyimpanan kunci: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Gagal membuka berkas kunci/sertifikat %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Gagal men-stat berkas kunci/sertifikat %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Gagal mengalokasikan penyangga sertifikat\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Gagal membaca sertifikat ke dalam memori: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Gagal menyiapkan struktur data PKCS#12: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Gagal mendekripsi berkas sertifikat PKCS#12\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Masukkan frasa sandi PKCS#12:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Gagal memroses berkas PKCS#12: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Gagal memuat sertifikat PKCS#12: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Pengimporan sertifikat X509 gagal: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Penataan sertifikat PKCS#12 gagal: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Tak bisa menginisialisasi hash MD5: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "Galat hash MD5: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Kurang DEK-Info: header dari kunci terenkripsi OpenSSL\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Tak bisa menentukan tipe enkripsi PEM\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Tipe enkripsi PEM yang tak didukung: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Salt tak valid dalam berkas PEM yang terenkripsi\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Galat saat mengawa kode base64 berkas PEM terenkripsi: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Berkas PEM terenkripsi terlalu pendek\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Gagal menginisialisasi cipher untuk pendekripsian berkas PEM: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Gagal mendekripsi kunci PEM: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Pendekripsian kunci PEM gagal\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Masukkan frasa sandi PEM:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Biner ini dibangun tanpa dukungan kunci sistem\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Biner ini dibangun tanpa dukungan PKCS#12\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Memakai sertifikat PKCS#11 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "Memakai sertifikat sistem %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Galat saat memuat sertifikat dari PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Galat saat memuat sertifikat sistem: %s\n"
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Memakai berkas sertifikat %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "Berkas PKCS#11 tak memuat sertifikat\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Tak ditemukan sertifikat dalam berkas"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Pemuatan sertifikat gagal: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "Memakai kunci sistem %s\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Galat saat menginisialisasi struktur kunci pribadi: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Galat saat mengimpor kunci sistem %s: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "Mencoba URL PKCS#11 %s\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Galat saat menginisialisasi struktur kunci PKCS#11: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Galat saat mengimpor URL PKCS#11 %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Memakai kunci PKCS#11 %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Galat saat mengimpor kunci PKCS#11 ke struktur kunci pribadi: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Memakai berkas kunci pribadi %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Versi OpenConnect ini dibangun tanpa dukungan TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Gagal mengintepretasi berkas PEM\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Gagal memuat kunci privat PKCS#1: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Gagal memuat kunci privat sebagai PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Gagal mendekripsi berkas sertifikat PKCS#8\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Gagal menentukan jenis kunci privat %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Masukkan frasa sandi PKCS#8:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Gagal memperoleh ID kunci: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Galat saat menandatangani data uji dengan kunci privat: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Galat saat memvalidasi tanda tangan terhadap sertifikat: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Tak ditemukan sertifikat SSL yang cocok dengan kunci privat\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Memakai sertifikat klien '%s'\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Pengaturan daftar pencabutan sertifikat gagal: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Gagal mengalokasikan memori untuk sertifikat\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "PERINGATAN: GnuTLS mengembalikan sert penerbit yang tak benar; otentikasi "
 "mungkin gagal!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "Mendapat CA berikutnya '%s' dari PKCS11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Gagal mengalokasikan memori untuk sertifikat pendukung\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Menambah dukungan CA '%s'\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Penataan sertifikat gagal: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Server tak menyajikan sertifikat\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr "Galat ketika membandingkan sert server saat jabat tangan ulang: %s\n"
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "Server menyajikan sertifikat lain saat jabat tangan ulang\n"
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "Server menyajikan sertifikat yang identik saat jabat tangan ulang\n"
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Galat saat menginisialisasi struktur sert X509\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Galat ketika mengimpor sert server\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Tak bisa menghitung hash dari sertifikat server\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Galat saat memeriksa status sert server\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "sertifikat dicabut"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "penandatangan tak ditemukan"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "penandatangan bukan suatu sertifikat CA"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "algoritma tak aman"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "sertifikat belum diaktifkan"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "sertifikat kadaluarsa"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "verifikasi tandatangan gagal"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "sertifikat tak cocok dengan nama host"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Gagal verifikasi sertifikat server: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Gagal mengalokasikan memori untuk sert cafile\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Gagal baca sert dari cafile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Gagal membuka berkas CA '%s': %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Pemuatan sertifikat gagal. Menggugurkan.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Gagal menata string prioritas TLS (\"%s\"): %s\n"
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Negosiasi SSL dengan %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Koneksi SSL dibatalkan\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Kegagalan koneksi SSL: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS kembalian tak fatal selama jabat tangan: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Tersambung ke HTTPS pada %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Renegosiasi SSL pada %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "Diperlukan PIN untuk %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "PIN salah"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Ini adalah percobaan terakhir sebelum penguncian!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Hanya beberapa percobaan tersisa sebelum mengunci!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Masukkan PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Algoritma HMAC OATH tak didukung\n"
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Gagal menghitung HMAC OATH: %s\n"
@@ -1683,7 +1709,7 @@ msgstr "Mencoba otentikasi Dasar HTTP ke proksi\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Mencoba otentikasi Dasar HTTP ke server '%s'\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Versi OpenConnect ini dibangun tanpa dukungan GSSAPI\n"
 
@@ -1701,235 +1727,235 @@ msgstr "Server '%s' meminta otentikasi Dasar yang secara baku dinonaktifkan\n"
 msgid "No more authentication methods to try\n"
 msgstr "Tak ada lagi metoda otentikasi yang dapat dicoba\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Tak ada memori untuk mengalokasikan cookie\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Gagal mengurai tanggapan HTTP '%s'\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Mendapat respon HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Galat saat memroses respon HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Mengabaikan baris respon HTTP tak dikenal '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Cookie yang tak valid ditawarkan: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Otentikasi sertifikat SSL gagal\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Tubuh respon punya ukuran negatif (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Transfer-Encoding tak dikenal: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP body %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Galat saat membaca tubuh respon HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Galat saat mengambil tajuk penggalan\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Galat saat mengambil tubuh respon HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Galat dalam pengawakodean terpenggal. Berharap '', mendapat: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Tak bisa menerima tubuh HTTP 1.0 tanpa menutup koneksi\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Gagal mengurai URL terbelokkan '%s': %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Tak bisa mengikuti pengalihan ke URL bukan https '%s'\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Gagal mengalokasikan path baru bagi pengalihan relatif: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Hasil %d yang tak diharapkan dari server\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "permintaan diberikan"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "kegagalan umum"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "koneksi tidak diijinkan oleh ruleset"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "jaringan tak dapat dijangkau"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "host tak dapat dihubungi"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "koneksi ditolak oleh host tujuan"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL kadaluarsa"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "perintah tidak didukung / galat protokol"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "tipe alamat tidak didukung"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr "Server SOCKS meminta nama pengguna/sandi tapi kami tak punya\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr "Nama pengguna dan sandi untuk otentikasi SOCKS mesti < 255 byte\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Galat saat menulis permintaan auth ke proksi SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Galat saat membaca respon auth dari proksi SOCKS: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Respon auth yang tak diharapkan dari proksi SOCKS: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Terotentikasi ke server SOCKS memakai sandi\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Otentikasi sandi ke server SOCKS gagal\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "Server SOCKS meminta otentikasi GSSAPI\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "Server SOCKS meminta otentikasi sandi\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "Server SOCKS memerlukan otentikasi\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "Server SOCKS meminta otentikasi yang tak dikenal bertipe %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Meminta koneksi proksi SOCKS ke %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Galat saat menulis permintaan koneksi ke proksi SOCKS: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Galat saat membaca respon koneksi dari proksi SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Respon koneksi yang tak diharapkan dari proksi SOCKS: %02x %02x\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Galat proksi SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Galat proksi SOCKS %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Tipe alamat yang tak diharapkan %02x dalam respon koneksi SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Meminta koneksi proksi HTTP ke %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Pengiriman permintaan proksi gagal: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Permintaan CONNECT proksi gagal: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Tipe proksi '%s' tak dikenal\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Hanya proksi http atau socks(5) yang didukung\n"
 
@@ -1942,45 +1968,62 @@ msgstr "Protokol VPN '%s' tak dikenal\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Dibangun terhadap pustaka SSL tanpa dukungan DTLS Cisco\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Gagal mengurai URL server '%s\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Hanya https:// yang diijinkan bagi URL server\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Tak ada penangan formulir; tak bisa mengotentikasi.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr "CommandLineToArgvW() gagal: %s\n"
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr "Galat fatal dalam penanganan baris perintah\n"
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() gagal: %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Galat saat mengonversi masukan konsol: %s\n"
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Kegagalan alokasi bagi string dari stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1989,25 +2032,21 @@ msgstr ""
 "Untuk bantuan atas OpenConnect, harap lihat halaman web di\n"
 " http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Memakai OpenSSL. Fitur yang ada:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Memakai GnuTLS. Fitur yang ada:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "MESIN OpenSSL tak ada"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "menggunakan OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2016,31 +2055,31 @@ msgstr ""
 "\n"
 "PERINGATAN: Tak ada dukungan DTLS dalam biner ini. Kinerja akan terganggu.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Tak bisa memroses path executable \"%s\" ini"
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Alokasi bagi path vpnc-script gagal\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Timpa nama host '%s' menjadi '%s'\n"
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Cara pakai:  openconnect [opsi] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2049,306 +2088,306 @@ msgstr ""
 "Klien terbuka bagi VPN Cisco AnyConnect, versi %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Baca opsi dari berkas konfig"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Lanjutkan di latar belakang setelah awal mula"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Tulis PID daemon ke berkas ini"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Pakai sertifikat klien SSL SERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Peringatkan ketika masa hidup sertifikat < HARI"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Memakai berkas kunci pribadi SSL KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Memakai cookie WebVPN COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Baca cookie dari masukan standar"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Aktifkan kompresi (baku)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Matikan kompresi"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Atur interval Dead Peer Detection (Deteksi Peer Mati) minimum"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Tata grup log masuk"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Tampilkan teks bantuan"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Memakai IFNAME untuk antar muka terowongan"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Pakai syslog untuk pesan-pesan kemajuan"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Sisipkan tanda waktu ke pesan-pesan kemajuan"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Lepas privilese setelah menyambung"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Lepas privilese selama eksekusi CSD"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Jalankan SKRIP sebagai pengganti biner CSD"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indikasikan MTU path dari/ke server"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Atur frasa sandi kunci atau PIN TPM SRK"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Frasa sandi kunci adalah fsid dari sistem berkas"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Tata server proksi"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Atur metoda otentikasi proksi"
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Matikan proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Pakai libproxy untuk menata proksi secara otomatis"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(CATATAN: libproxy dimatikan dalam build ini)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Persyaratkan perfect forward secrecy"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Keluaran lebih sedikit"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Atur batas antrian paket ke LEN paket"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "Baris perintah shell untuk memakai skrip konfig kompatibel vpnc"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "baku"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Lewatkan trafik ke program 'skrip', bukan tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Tata nama log masuk"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Laporkan nomor versi"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Lebih banyak keluaran"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Curahkan trafik otentikasi HTTP (mengimplikasikan --verbose)"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Berkas konfig XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Pilih otentikasi log masuk"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Hanya otentikasi dan cetak info log masuk"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Ambil cookie webvpn saja; jangan menyambung"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Cetak cookie webvpn sebelum menyambung"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Berkas cert bagi verifikasi server"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Jangan meminta konektivitas IPv6"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Cipher OpenSSL yang didukung untuk DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Matikan DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Nonfungsikan pemakaian ulang koneksi HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Matikan otentikasi sandi/SecurID"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Jangan mempersyaratkan agar sert SSL server mesti valid"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Nonaktifkan certificate authority sistem baku"
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Jangan coba otentikasi XML POST"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Jangan mengharapkan masukan pengguna; keluar bila itu diperlukan"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Baca kata sandi dari masukan standar"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Tipe token perangkat lunak: rsa, totp, atau hotp"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Rahasia token perangkat lunak"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(CATATAN: libstoken (RSA SecurID) dimatikan dalam build ini)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(CATATAN: OATH YubiKey dimatikan dalam build ini)"
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Tenggat waktu coba ulang koneksi dalam detik"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Sidik jari SHA1 sertifikat server"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP header ruas User-Agent:"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Nama host yang diumumkan ke server"
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Pakai IP ketika menyambung ke HOST"
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Tipe OS (linux,linux-64,win,…) untuk dilaporkan"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Atur port lokal bagi datagram DTLS"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Gagal mengalokasikan string\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Gagal memperoleh baris dari berkas konfigurasi: '%s'\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Opsi tak dikenal di baris %d: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Opsi '%s' tak meminta argumen pada baris %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Opsi '%s' memerlukan argumen pada baris %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Pengguna tidak valid \"%s\": %s\n"
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "ID pengguna tidak valid \"%d\": %s\n"
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2359,7 +2398,7 @@ msgstr ""
 "            iconv tapi nampaknya Anda memakai set karakter legasi\n"
 "            \"%s\". Bersiaplah mengalami keanehan.\n"
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2368,42 +2407,42 @@ msgstr ""
 "PERINGATAN: Versi openconnect ini adalah %s tapi\n"
 "            pustaka libopenconnect adalah %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Gagal mengalokasikan struktur vpninfo\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Tak bisa memakai opsi 'config' di dalam berkas konfig\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Tak bisa membuka berkas konfig '%s': %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Mode kompresi '%s' yang tak valid\n"
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Kurang titik dua dalam opsi resolve\n"
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Gagal mengalokasikan memori\n"
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d terlalu kecil\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2414,124 +2453,131 @@ msgstr ""
 "Bila ini membantu, harap laporkan ke <openconnect-devel@lists.infradead."
 "org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Panjang antrian nol tak diijinkan; memakai 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect versi %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Mode token perangkat lunak yang tak valid \"%s\"\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Identitas OS tidak sah \"%s\"\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Argumen terlalu banyak pada baris perintah\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Tak ada server yang dinyatakan\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Versi openconnect ini dibangun tanpa dukungan libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Gagal membuka pipa cmd\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Gagal mendapat cookie WebVPN\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Pembuatan koneksi SSL gagal\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Penyiapan DTLS gagal; memakai SSL sebagai gantinya\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Terhubung sebagai %s%s%s, memakai %s%s\n"
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr "Tak ada argumen --script yang diberikan; DNS dan routing tak ditata\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Lihat http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Gagal membuka '%s' untuk menulis: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Menlanjutkan di latar belakang; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Pengguna meminta sambung ulang\n"
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Cookie ditolak saat koneksi; keluar.\n"
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Sesi diakhiri oleh server; keluar.\n"
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Pengguna membatalkan (SIGINT); keluar.\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Pengguna melepas dari sesi (SIGHUP); keluar.\n"
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Galat tak dikenal; keluar.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Gagal membuka %s untuk menulis: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Gagal menulis konfig ke %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Sertifikat SSL server tak cocok: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2542,91 +2588,102 @@ msgstr ""
 "Sertifikat dari server VPN \"%s\" gagal verifikasi.\n"
 "Alasan: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Masukkan '%s' untuk menerima, '%s' untuk menggugurkan; sebarang yang lain "
 "untuk menilik:"
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "tidak"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "ya"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Hash kunci server: %s\n"
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Pilihan auth \"%s\" cocok dengan opsi berganda\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Pilihan auth \"%s\" tak tersedia\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Masukan pengguna diperlukan dalam mode non interaktif\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Gagal membuka berkas token untuk menulis: %s\n"
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Gagal menulis token: %s\n"
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "String token lunak tak valid\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Tak bisa membuka berkas ~/.stokenrc\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect tak dibangun dengan dukungan libstoken\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Kegagalan umum dalam libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect tak dibangun dengan dukungan liboath\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Kegagalan umum dalam liboath\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Token YubiKey tak ditemukan\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "OpenConnect tak dibangun dengan dukungan YubiKey\n"
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Kegagalan umum Yubikey: %s\n"
@@ -2641,16 +2698,16 @@ msgstr "Penyiapan skrip tun gagal\n"
 msgid "Set up tun device failed\n"
 msgstr "Penyiapan perangkat tun gagal\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Pemanggil mengistirahatkan koneksi\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Tak ada pekerjaan; tidur selama %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "WaitForMultipleObjects gagal: %s\n"
@@ -2716,7 +2773,7 @@ msgstr "Server menolak token lunak; berpindah ke entri manual\n"
 msgid "Generating OATH TOTP token code\n"
 msgstr "Menjangkitkan kode token OATH TOTP\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Menjangkitkan kode token OATH HOTP\n"
 
@@ -2848,503 +2905,620 @@ msgstr "Mendapat KMP pesan %d berukuran %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Menerima TLV non-ESP (group %d) dalam KMP negosiasi ESP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Kesalahan saat membuat permintaaan negosiasi oNCP\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Tulis pendek dalam negosiasi oNCP\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Baca %d byte dari record SSL\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Respon tak diharapkan berukuran %d setelah paket nama host\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Respon server ke paket nama host salah 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Paket tak valid saat menunggu KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Mengharapkan pesan KMP 301 dari server tapi memperoleh %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "Pesan 301 KMP dari server terlalu besar (%d byte)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Mendapat pesan KMP 301 sepanjang %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Gagal membaca panjang rekaman lanjutan\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "Catatan tambahan %d byte terlalu besar; akan membuat %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Gagal membaca rekaman lanjutan sepanjang %d\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Membaca tambahan %d byte KMP pesan 301\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Kesalahan saat menegosiasi kunci ESP\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "masuk baru"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "keluar baru"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "Mengabaikan kunci ESP karena dukungan ESP tak tersedia pada build ini\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Membaca hanya 1 byte ruas panjang oNCP\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "Server mengakhiri koneksi (sesi kedaluarsa)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "Server mengakhiri koneksi (alasan: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "Server mengirim rekaman oNCP panjang-nol\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "KMP masuk pesan %d berukuran %d (mendapat %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr "Melanjutkan memroses KMP pesan %d kini ukuran %d (mendapat %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Paket data tak dikenal\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Pesan KMP %d tak dikenal berukuran %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d byte lagi belum diterima\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Paket keluar:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Mengirim paket kendali fungsikan ESP\n"
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "GALAT: %s() dipanggil dengan UTF-8 yang tak valid bagi argumen '%s'\n"
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Gagal membuat SSL_SESSION ASN.1 untuk OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "OpenSSL gagal mengurai SSL_SESSION ASN.1\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Inisialisasi sesi DTLSv1 gagal\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Inisialisasi DTLSv1 CTX gagal\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Penataan daftar cipher DTLS gagal\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Bukan secara tepat satu cipher DTLS\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() gagal dengan versi protokol lama 0x%x\n"
+"Apakah Anda memakai versi OpenSSL yang lebih tua dari 0.9.8m?\n"
+"Lihat http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Pakai opsi baris perintah --no-dtls untuk menghindari pesan ini\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "Terjalin koneksi DTLS (memakai OpenSSL). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"OpenSSL Anda lebih tua daripada yang Anda pakai untuk membangun, sehingga "
+"DTLS mungkin gagal!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Ini mungkin karena OpenSSL Anda rusak\n"
+"Lihat http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Jabat tangan DTLS gagal: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Gagal menginisialisasi cipher ESP:\n"
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr "Gagal menginisialisasi HMAC ESP\n"
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr "Gagal membuat kunci acak bagi ESP:\n"
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr "Gagal menyiapkan konteks dekripsi bagi paket ESP:\n"
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr "Gagal mendekripsi paket ESP:\n"
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr "Gagal membuat IV acak bagi paket ESP:\n"
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr "Gagal menyiapkan konteks enkripsi bagi paket ESP:\n"
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr "Gagal mengenkripsi paket ESP:\n"
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr "Gagal menjalin konteks PKCS#11 libp11:\n"
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr "Gagal memuat modul penyedia PKCS#11 (%s):\n"
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN terkunci\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN kedaluarsa\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Pengguna lain telah log masuk\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr "Galat tak dikenal saat log masuk ke token PKCS#11\n"
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr "Log masuk ke slot PKCS#11 '%s'\n"
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr "Gagal meng-enumerasi cert dalam slot PKCS#11 '%s'\n"
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr "Menemukan %d cert dalam slot '%s'\n"
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr "Gagal mengurai URI PKCS#11 '%s'\n"
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr "Gagal meng-enumerasi slot PKCS#11\n"
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr "Log masuk ke slot PKCS#11 '%s'\n"
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "Isi X.509 sertifikat tidak diambil oleh libp11\n"
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Gagal memasang sertifikat dalam konteks OpenSSL\n"
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr "Gagal meng-enumerasi kunci dalam slot PKCS#11 '%s'\n"
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr "Menemukan %d kunci dalam slot '%s'\n"
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr "Gagal meng-instansiasi kunci privat dari PKCS#11\n"
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr "Gagal menambah kunci dari PKCS#11\n"
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Versi OpenConnect ini dibangun tanpa dukungan PKCS#11\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Gagal menulis ke soket SSL\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Gagal baca dari soket SSL\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Galat baca SSL %d (server mungkin menutup koneksi); menyambung ulang.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write gagal: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Permintaan UI SSL tak tertangani bertipe %d\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Kata sandi PEM terlalu panjang (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Sertifikat ekstra dari %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Mengurai PKCS#12 gagal (lihat galat di atas)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 tak memuat sertifikat!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 tak memuat kunci privat!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Tak bisa memuat mesin TPM.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Gagal init mesin TPM\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Gagal menata kata sandi SRK TPM\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Gagal memuat kunci privat TPM\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Gagal menambah kunci dari TPM\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Gagal membuka berkas sertifikat %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Pemuatan sertifikat gagal\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr "Gagal memroses semua sertifikat pendukung. Tetap mencoba...\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "berkas PEM"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Gagal membuat BIO bagi butir penyimpanan kunci '%s'\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Memuat kunci privat gagal (kata sandi salah?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Memuat kunci privat gagal (lihat galat di atas)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Gagal memuat sertifikat X509 dari penyimpanan kunci\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Gagal memakai sertifikat X509 dari penyimpanan kunci\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Gagal memakai kunci privat dari penyimpanan kunci\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Gagal membuka berkas kunci pribadi %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Memuat kunci privat gagal\n"
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Gagal mengidentifikasi tipe kunci privat dalam '%s'\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Altname DNS cocok '%s'\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Tak ada yang cocok dengan altname '%s'\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Sertifikat memiliki altname GEN_IPADD dengan panjang palsu %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Cocok alamat %s '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Tak ada kecocokan bagi alamat %s '%s'\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' mengandung path tak kosong; mengabaikan\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Cocok URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Tidak ada yang cocok untuk URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Tak ada altname dalam sert pasangan cocok dengan '%s'\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Tak ada nama subjek dalam sert pasangan!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Gagal mengurai nama subjek dalam sert pasangan\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Subjek sert pasangan tak cocok ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Nama subjek sertifikat pasangan cocok '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Sert ekstra dari cafile: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Galat dalam sert klien ruas notAfter\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<galat>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Gagal baca sert dari berkas CA '%s'\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Gagal membuka berkas CA '%s'\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Kegagalan koneksi SSL\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Gagal menghitung HMAC OATH\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Buang split buruk termasuk: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Buang split buruk selain: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Gagal spawn skrip '%s' bagi %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Skrip '%s' berhenti secara abnormal (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Skrip '%s' mengembalikan galat %d\n"
@@ -3643,84 +3817,96 @@ msgstr "Format PIN tak valid; coba lagi.\n"
 msgid "Generating RSA token code\n"
 msgstr "Menjangkitkan kode token RSA\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Galat saat mengakses kunci registri bagi adaptor jaringan\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Mengabaikan antar muka TAP \"%s\" yang tak cocok\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Tak ditemukan adaptor Windows-TAP. Apakah driver terpasang?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Gagal membuka %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Membuka perangkat tun: %s\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Gagal memperoleh versi driver TAP: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Galat: Diperlukan driver TAP-Windows v9.9 atau lebih (ditemukan %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Gagal menata alamat IP TAP: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Gagal menata status media TAP: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "Perangkat TAP menggugurkan ketersambungan. Memutus.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Gagal membaca dari perangkat TAP: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Gagal melengkapi baca dari perangkat TAP: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Menulis %ld byte ke tun\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Menunggun menulis tun…\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Menulis %ld byte ke tun setelah menunggu\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Gagal menulis ke perangkat TAP: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Span skrip tunnel belum didukung pada Windows\n"
 
diff --git a/po/is.po b/po/is.po
index 23bbf977..51e35fbd 100644
--- a/po/is.po
+++ b/po/is.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Icelandic (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/it.po b/po/it.po
index 84eec7ba..a8e925a4 100644
--- a/po/it.po
+++ b/po/it.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Italian (http://www.transifex.net/projects/p/meego/team/it/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,543 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Servizio VPN non disponibile; motivo: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Tipo di compressione %d sconosciuto\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Allocazione non riuscita\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"La versione di OpenSSL disponibile è più vecchia di quella usata durante la "
-"compilazione: DTLS potrebbe non funzionare."
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Impossibile determinare il tipo di cifratura PEM\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "In uso certificato PKCS#11 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "In uso certificato di sistema %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "In uso chiave di sistema %s\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "In uso chiave PKCS#11 %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "In uso file chiave privata %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certificato scaduto"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Codice PIN errato"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Ultimo tentativo prima del blocco"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL scaduto"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "tipo di indirizzo non supportato"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Tipo di proxy «%s» non valido\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "In uso OpenSSL. Funzionalità disponibili:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "In uso GnuTLS. Funzionalità disponibili:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "In uso OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "File di configurazione XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Certificato per la verifica server"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Impossibile aprire il file di configurazione \"%s\": %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "sì"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Impossibile aprire il file ~/.stokenrc\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Token Yubikey non trovato\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Il chiamante ha messo in pausa la connessione\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2863,612 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"La versione di OpenSSL disponibile è più vecchia di quella usata durante la "
+"compilazione: DTLS potrebbe non funzionare."
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Un altro utente è già collegato\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Impossibile caricare il motore TPM.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ja.po b/po/ja.po
index aea84ccf..80e4783d 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Japanese (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ka.po b/po/ka.po
index a650ddfe..1c8d25a2 100644
--- a/po/ka.po
+++ b/po/ka.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Georgian (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/km.po b/po/km.po
index eefdb58e..e14859b1 100644
--- a/po/km.po
+++ b/po/km.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Khmer (http://www.transifex.net/projects/p/meego/team/km/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/kn.po b/po/kn.po
index cc3f0ace..f86df182 100644
--- a/po/kn.po
+++ b/po/kn.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: network-manager-openconnect.po.master.kn\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2009-08-14 11:59+0530\n"
 "Last-Translator: Shankar Prasad <svenkate@redhat.com>\n"
 "Language-Team: Kannada <en@li.org>\n"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ko.po b/po/ko.po
index 9758a931..5f4564f4 100644
--- a/po/ko.po
+++ b/po/ko.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Korean (http://www.transifex.net/projects/p/meego/team/ko/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ku.po b/po/ku.po
index d20e8cc2..980639e4 100644
--- a/po/ku.po
+++ b/po/ku.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Kurdish (http://www.transifex.net/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/lo.po b/po/lo.po
index cdfd170d..b0d34386 100644
--- a/po/lo.po
+++ b/po/lo.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Lao (http://www.transifex.net/projects/p/meego/team/lo/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/lt.po b/po/lt.po
index 724209e7..9ad88e95 100644
--- a/po/lt.po
+++ b/po/lt.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-09-23 11:15+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Lithuanian (http://www.transifex.net/projects/p/meego/team/"
@@ -178,7 +178,7 @@ msgstr "Prašyta slaptažodžio, bet nustatyta „--no-passwd“\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Neparsiunčiamas XML profilis, nes SHA1 jau atitinka\n"
 
-#: auth.c:921 cstp.c:316 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Nepavyko atverti HTTPS ryšio į %s\n"
@@ -315,454 +315,454 @@ msgstr "(Klaida aprašant klaidą!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "KLAIDA: nepavyksta inicializuoti lizdų\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:275
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "KRITINĖ KLAIDA: DTLS pagrindinė paslaptis neinicializuota. Praneškite apie "
 "tai.\n"
 
-#: cstp.c:293
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Klaida kuriant HTTPS CONNECT užklausą\n"
 
-#: cstp.c:309 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Klaida parsiunčiant HTTPS atsakymą\n"
 
-#: cstp.c:336
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN tarnyba neprieinama; priežastis: %s\n"
 
-#: cstp.c:341
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Gautas netinkamas HTTP CONNECT atsakymas: %s\n"
 
-#: cstp.c:348
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Gautas CONNECT atsakymas: %s\n"
 
-#: cstp.c:376 cstp.c:384
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Nėra atminties parametrams\n"
 
-#: cstp.c:393 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:412
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID ne 64 simboliai; yra: „%s“\n"
 
-#: cstp.c:429
+#: cstp.c:433
 #, c-format
 msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:447
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Nežinomas CSTP-Content-Encoding %s\n"
 
-#: cstp.c:483
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Nežinomas CSTP-Content-Encoding %s\n"
 
-#: cstp.c:556
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Negauta MTU. Nutraukiama\n"
 
-#: cstp.c:564
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Negautas IP adresas. Nutraukiama\n"
 
-#: cstp.c:570
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Gauta IPv6 konfigūracija, bet MTU %d yra per mažas.\n"
 
-#: cstp.c:576
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Persijungimas gavo skirtingą seną IP adresą (%s != %s)\n"
 
-#: cstp.c:584
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Persijungimas gavo skirtingą seną IP tinklo kaukę (%s != %s)\n"
 
-#: cstp.c:592
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Persijungimas gavo skirtingą IPv6 adresą (%s != %s)\n"
 
-#: cstp.c:600
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Persijungimas gavo skirtingą IPv6 tinklo kaukę (%s != %s)\n"
 
-#: cstp.c:620
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "Prisijungta prie CSTP. DPD %d, keepalive %d\n"
 
-#: cstp.c:622
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP šifravimo rinkinys: %s\n"
 
-#: cstp.c:684
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Nepavyko nustatyti suspaudimo\n"
 
-#: cstp.c:701
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Nepavyko išskirti buferio\n"
 
-#: cstp.c:759
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "buferis nepavyko\n"
 
-#: cstp.c:782
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "LZS išskleidimas nepavyko: %s\n"
 
-#: cstp.c:795
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "LZ4 išskleidimas nepavyko\n"
 
-#: cstp.c:802
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Nežinomas suspaudimo tipas %d\n"
 
-#: cstp.c:807
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Gautas %s suspaustas %d baitų duomenų paketas (buvo %d)\n"
 
-#: cstp.c:827
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "nepavyko išskleisti %d\n"
 
-#: cstp.c:897 dtls.c:239 dtls.c:698 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Nepavyko išskirti atminties\n"
 
-#: cstp.c:908
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Gautas trumpas paketas (%d baitai)\n"
 
-#: cstp.c:921
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Nelauktas paketo ilgis. SSL_read grąžino %d, bet paketas yra\n"
 
-#: cstp.c:935
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Gauta CSTP DPD užklausa\n"
 
-#: cstp.c:941
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Gautas CSTP DPD atsakymas\n"
 
-#: cstp.c:946
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Gautas CSTP Keepalive\n"
 
-#: cstp.c:951 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Gautas nespaustų duomenų paketas iš %d baitų\n"
 
-#: cstp.c:968
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Gautas serverio atsijungimas: %02x „%s“\n"
 
-#: cstp.c:971
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Gautas serverio atsijungimas\n"
 
-#: cstp.c:979
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Suspaustas paketas gautas ne spaudimo veiksenoje\n"
 
-#: cstp.c:988
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "gautas serverio pabaigos paketas\n"
 
-#: cstp.c:995
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Nežinomas paketas %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1038 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL įrašė per mažai baitų! Prašyta %d, išsiųsta %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1066 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Atliekamas CSTP raktų pakeitimas\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1073 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Pakartotinis rankos paspaudimas nepavyko; bandomas naujas tunelis\n"
 
-#: cstp.c:1084 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTO negyvų porininkų aptikimas aptiko negyvą porininką!\n"
 
-#: cstp.c:1088 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Nepavyko persijungimas\n"
 
-#: cstp.c:1104 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Siųsti CSTO DPD\n"
 
-#: cstp.c:1116 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Siųsti CSTO Keepalive\n"
 
-#: cstp.c:1141
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Siunčiamas suspaustų duomenų paketas iš %d baitų (buvo %d)\n"
 
-#: cstp.c:1152 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Siunčiamas nespaustų duomenų paketas iš %d baitų\n"
 
-#: cstp.c:1191
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Siųsti BYE paketą: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Bandoma nusiųsti tapatybės patvirtinimą į tarpinį serverį\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Bandoma nusiųsti tapatybės patvirtinimą į tarpinį serverį „%s“\n"
 
-#: dtls.c:75
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "DTLS ryšys bandytas su esamu fd\n"
 
-#: dtls.c:81
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Nėra DTLS adreso\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:88
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Serveris nepasiūlė DTLS šifro parinkties\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:95
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Nėra DTLS jungiantis per tarpinį serverį\n"
 
-#: dtls.c:157
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS parametras %s: %s\n"
 
-#: dtls.c:198
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS inicializuota. DPD %d, Keepalive %d\n"
 
-#: dtls.c:224
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Bandomas naujas DTLS ryšys\n"
 
-#: dtls.c:250
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Gautas DTKS paketas 0x%02x iš %d baitų\n"
 
-#: dtls.c:264
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Gauta DTLS DPD užklausa\n"
 
-#: dtls.c:270
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Nepavyko išsiųsti DPD atsakymo. Tikėkitės atsijungimo\n"
 
-#: dtls.c:274
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Gautas DTLS DPD atsakymas\n"
 
-#: dtls.c:278
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Gautas DTLS Keepalive\n"
 
-#: dtls.c:284
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Gautas suspaustas DTLS paketas, kai suspaudimas nėra įjungtas\n"
 
-#: dtls.c:292
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Nežinomas DTLS paketo tipas %02x, ilgis %d\n"
 
-#: dtls.c:314
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Atliekamas DTLS raktų pasikeitimas\n"
 
-#: dtls.c:321
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Nepavyko DTLS rankos paspaudimas; jungiamasi iš naujo.\n"
 
-#: dtls.c:330
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS negyvų porininkų aptikimas aptiko negyvą porininką!\n"
 
-#: dtls.c:336
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Siųsti DTLS DPD\n"
 
-#: dtls.c:341
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Nepavyko siųsti DPD užklausos. Tikėkitės atsijungimo\n"
 
-#: dtls.c:354
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Siųsti DTLS Keepalive\n"
 
-#: dtls.c:359
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Nepavyko siųsti keepalive užklausos. Tikėkitės atsijungimo\n"
 
-#: dtls.c:390 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Gautas nežinomas paketas (ilgis %d): %02x %02x %02x %02x...\n"
 
-#: dtls.c:397
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr "Šis TOS: %d, paskutinis TOS: %d\n"
 
-#: dtls.c:401
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr "UDP setsockopt"
 
-#: dtls.c:432
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS gavo rašymo klaidą %d. Pereinama prie SSL\n"
 
-#: dtls.c:446
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS gavo rašymo klaidą: %s. Pereinama prie SSL\n"
 
-#: dtls.c:461
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Siunčiamas DTLS paketas iš %d baitų; DTLS siutimas grąžino %d\n"
 
-#: dtls.c:489
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Inicijuojamas IPv4 MTU aptikimas (min=%d, max=%d)\n"
 
-#: dtls.c:509
+#: dtls.c:527
 msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:513
+#: dtls.c:531
 #, c-format
 msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:522
+#: dtls.c:540
 #, c-format
 msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:526
+#: dtls.c:544
 #, c-format
 msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:540 dtls.c:648
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr "Gautas nelauktas paketas (%.2x) MTU aptikime; praleidžiama.\n"
 
-#: dtls.c:552
+#: dtls.c:570
 #, c-format
 msgid "Timeout while waiting for DPD response; trying %d\n"
 msgstr ""
 
-#: dtls.c:559 dtls.c:640
+#: dtls.c:577 dtls.c:658
 msgid "Timeout while waiting for DPD response; resending probe.\n"
 msgstr ""
 
-#: dtls.c:566 dtls.c:667
+#: dtls.c:584 dtls.c:685
 #, c-format
 msgid "Failed to recv DPD request (%d)\n"
 msgstr ""
 
-#: dtls.c:571
+#: dtls.c:589
 #, c-format
 msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:609
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Inicijuojamas IPv6 MTU aptikimas\n"
 
-#: dtls.c:624
+#: dtls.c:642
 #, c-format
 msgid "Sending MTU DPD probe (%u bytes)\n"
 msgstr ""
 
-#: dtls.c:628
+#: dtls.c:646
 #, c-format
 msgid "Failed to send DPD request (%d)\n"
 msgstr ""
 
-#: dtls.c:653
+#: dtls.c:671
 #, c-format
 msgid "Received MTU DPD probe (%u bytes)\n"
 msgstr ""
 
-#: dtls.c:717
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "Aptiktas %d baitų MTU (buvo %d)\n"
 
-#: dtls.c:720
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Po aptikimo nėra MTU pasikeitimo (buvo %d)\n"
@@ -892,6 +892,97 @@ msgstr "Nepavyko išsiųsti ESP paketo: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Siųsti ESP paketą iš %d baitų\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Nežinomi DTLS parametrai prašomam CipherSuite „%s“\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Nepavyko nustatyti DTLS prioriteto: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Nepavyko nustatyti DTLS sesijos prametrų: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Nepavyko nustatyti DTLS MTU: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Užmegztas DTLS ryšys (naudojant GnuTLS). Šifrų rinkinys %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr "DTLS ryšio suspaudimas, naudojant %s.\n"
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS rankos paspaudimo laikas baigėsi\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Nepavyko DTLS rankos paspaudimas: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(Ar ugniasienė neleidžia jums siųsti UDP paketų?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -931,7 +1022,7 @@ msgstr "Nepavyko sugeneruoti ESO paketo IV: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Nepavyko užšifruoti ESP paketo: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL rašymas atšauktas\n"
 
@@ -940,7 +1031,7 @@ msgstr "SSL rašymas atšauktas\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Nepavyko rašyti į SSL lizdą: %s\n"
 
-#: gnutls.c:176 gnutls.c:268 openssl.c:191 openssl.c:258
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL skaitymas atšauktas\n"
 
@@ -970,15 +1061,15 @@ msgstr "Nepavyko SSL siuntimas: %s\n"
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Nepavyko išgauti liudijimo galiojimo pabaigos laiko\n"
 
-#: gnutls.c:351 openssl.c:1611
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Kliento liudijimo galiojimas baigėsi"
 
-#: gnutls.c:353 openssl.c:1616
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Kleinto liudijimas biags galioti"
 
-#: gnutls.c:402 openssl.c:786
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Nepavyko įkelti elemento „%s“ iš įvesties: %s\n"
@@ -1007,11 +1098,11 @@ msgstr "Nepavyko perskaityti liudijimo į atmintį: %s\n"
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Nepavyko nustatyti PKCS#12 duomenų struktūros: %s\n"
 
-#: gnutls.c:493 openssl.c:555
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Nepavyko dešifruoti PKCS#12 liudijimo failo\n"
 
-#: gnutls.c:497 openssl.c:558
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Įveskite PKCS#12 slaptažodį:"
 
@@ -1085,7 +1176,7 @@ msgstr "Nepavyko dešifruoti PEM rakto: %s\n"
 msgid "Decrypting PEM key failed\n"
 msgstr "Nepavyko dešifruoti PEM rakto\n"
 
-#: gnutls.c:996 gnutls.c:1530 openssl.c:479
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Įveskite PEM slaptažodį:"
 
@@ -1117,7 +1208,7 @@ msgstr "Klaida įkeliant liudijimą iš PKCS#11: %s\n"
 msgid "Error loading system certificate: %s\n"
 msgstr "Klaida įkeliant sistemos liudijimą: %s\n"
 
-#: gnutls.c:1159 openssl.c:842
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Naudojamas liudijimo failas %s\n"
@@ -1180,7 +1271,7 @@ msgstr "Klaida importuojant PKCS#11 raktą į privataus rakto struktūrą: %s\n"
 msgid "Using private key file %s\n"
 msgstr "Naudojamas privataus rakto failas %s\n"
 
-#: gnutls.c:1451 openssl.c:666
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Ši OpenConnect versija sukurta be TPM palaikymo\n"
 
@@ -1198,7 +1289,7 @@ msgstr "Nepavyko įkelti PKCS#1 privataus rakto: %s\n"
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Nepavyko įkelti privataus rakto kaip PKCS#8: %s\n"
 
-#: gnutls.c:1526 gnutls.c:1559 openssl.c:1013 openssl.c:1023
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Nepavyko dešifruoti PKCS#8 liudijimo failo\n"
 
@@ -1207,7 +1298,7 @@ msgstr "Nepavyko dešifruoti PKCS#8 liudijimo failo\n"
 msgid "Failed to determine type of private key %s\n"
 msgstr "Nepavyko nustatyti privataus rakto %s tipo\n"
 
-#: gnutls.c:1563 openssl.c:1019
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Įveskite PKCS#8 slaptažodį:"
 
@@ -1230,7 +1321,7 @@ msgstr "Klaida tikrinant parašą su liudijimu: %s\n"
 msgid "No SSL certificate found to match private key\n"
 msgstr "Nerastas SSL liudijimas, atitinkantis privatų raktą\n"
 
-#: gnutls.c:1675 openssl.c:581 openssl.c:724
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Naudojamas kliento liudijimas „%s“\n"
@@ -1274,159 +1365,159 @@ msgstr "Pridedama palaikanti LĮ „%s“\n"
 msgid "Setting certificate failed: %s\n"
 msgstr "Nepavyko nustatyti liudijimo: %s\n"
 
-#: gnutls.c:2074
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Serveris nepateikė liudijimo\n"
 
-#: gnutls.c:2082
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 "Klaida lyginant serverio liudijimą pakartotiniame rankos paspaudime: %s\n"
 
-#: gnutls.c:2087 openssl.c:1534
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "Serveris pateikė kitokį liudijimą pakartotiniame rankos paspaudime\n"
 
-#: gnutls.c:2092 openssl.c:1537
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 "Serveris pateikė identišką liudijimą pakartotiniame rankos paspaudime\n"
 
-#: gnutls.c:2098
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Klaida inicializuojant X509 liudijimo struktūrą\n"
 
-#: gnutls.c:2104
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Klaida importuojant serverio liudijimą\n"
 
-#: gnutls.c:2113 main.c:1691
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Nepavyko suskaičiuoti serverio liudijimo maišos vertės\n"
 
-#: gnutls.c:2118
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Klaida tikrinant serverio liudijimo būseną\n"
 
-#: gnutls.c:2123
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "liudijimas atšauktas"
 
-#: gnutls.c:2125
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "pasirašytojas nerastas"
 
-#: gnutls.c:2127
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "pasirašytojas nėra LĮ liudijimas"
 
-#: gnutls.c:2129
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "nesaugus algoritmas"
 
-#: gnutls.c:2131
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "liudijimas dar neaktyvuotas"
 
-#: gnutls.c:2133
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "liudijimo galiojimas baigėsi"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2138
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "nepavyko patikrinti liudijimo"
 
-#: gnutls.c:2187 openssl.c:1418 openssl.c:1570
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "liudijimas neatitinka serverio vardo"
 
-#: gnutls.c:2192 openssl.c:1417 openssl.c:1576
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Nepavyko serverio liudijimo patikrinimas: %s\n"
 
-#: gnutls.c:2264
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Klaida išskiriant atmintį cafile liudijimams\n"
 
-#: gnutls.c:2285
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Nepavyko perskaityti liudijimų iš cafile: %s\n"
 
-#: gnutls.c:2301
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Nepavyko atverti LŠ failo „%s“: %s\n"
 
-#: gnutls.c:2314 openssl.c:1698
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Nepavyko įkelti liudijimo. Nutraukiama.\n"
 
-#: gnutls.c:2385
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Nepavyko nustatyti TLS prioriteto eilutės („%s“): %s\n"
 
-#: gnutls.c:2397 openssl.c:1815
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL derybos su %s\n"
 
-#: gnutls.c:2444 openssl.c:1841
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL ryšys nutrauktas\n"
 
-#: gnutls.c:2451
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL ryšio klaida: %s\n"
 
-#: gnutls.c:2460
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS nelemtinga grįžimas rankos paspaudimo metu: %s\n"
 
-#: gnutls.c:2466 openssl.c:1858
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Prisijungta prie HTTPS %s\n"
 
-#: gnutls.c:2469
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Iš naujo užmezgamas SSL su %s\n"
 
-#: gnutls.c:2776 openssl-pkcs11.c:199
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "%s būtinas PIN"
 
-#: gnutls.c:2780 openssl-pkcs11.c:202
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Neteisingas PIN"
 
-#: gnutls.c:2783
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Tai yra galutinis bandymas prie užrakinant!"
 
-#: gnutls.c:2785
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Liko tik keli bandymai prieš užrakinimą!"
 
-#: gnutls.c:2790 openssl-pkcs11.c:206
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Įveskite PIN:"
 
-#: gnutls.c:2921 openssl.c:1986
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Nepalaikomas OATH HMAC algoritmas\n"
 
-#: gnutls.c:2930
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Nepavyko suskaičiuoti OATH HMAC: %s\n"
@@ -1628,7 +1719,7 @@ msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 "Bandomas HTTP Basic tapatybės patvirtinimas tarpiniame serveryje „%s“\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Ši OpenConnect versija sukurta be GSSAPI palaikymo\n"
 
@@ -1650,239 +1741,239 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Daugiau nebėra bandomų tapatybės patvirtinimo metodų\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Nėra atminties slapukams\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Nepavyko perskaityti HTTP atsakymo „%s“\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Gautas HTTP atsakymas: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Klaida apdorojant HTTP atsakymą\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Nepaisoma nežinomo HTTP atsakymo eilutėje „%s“\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Pasiūlytas neteisingas slapukas: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL liudijimo tapatybės patvirtinimas nepavyko\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Atsakymo pagrindinė dalis yra neigiamo dydžio (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Nežinoma perdavimo koduotė: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP pagrindinė dalis %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Klaida skaitant HTTP atsakymo pagrindinę dalį\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Klaida parsiunčiant dalies antraštę\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Klaida parsiunčiant HTTP atsakymo pagrindinę dalį\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Klaida padalintame dekodavime. Tikėtasi „“, gauta: „%s“"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Negalima gauti HTTP 1.0 pagrindinės dalies neužveriant ryšio\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Nepavyko perskaityti nukreiptojo URL „%s“: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Negalima sekti nukreipimu į ne https URL „%s“\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Nepavyko išskirti naujo kelio santykiniam nukreipimui: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Netikėtas %d rezultatas iš serverio\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "prašymas patvirtintas"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "bendroji klaida"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "ryšis neleistas pagal taisykles"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "tinklas nepasiekiamas"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "serveris nepasiekiamas"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "ryšį atmetė paskirties serveris"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL laikas baigėsi"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "komanda nepalaikoma / protokolo klaida"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "adreso tipas nepalaikomas"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "SOCKS serveris paprašė naudotojo vardo/slaptažodžio, bet mes jokių neturime\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "Naudotojo vardas ir slaptažodis SOCKS tapatybės patvirtinimui turi būti < "
 "255 baitai\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Klaida rašant auth užklausą į SOCKS tarpinį serverį: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Klaida skaitant auth atsakymą iš SOCKS tarpinio serverio: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Netikėtas auth atsakymas iš SOCKS tarpinio serverio: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Patvirtinta tapatybė SOCKS serveryje naudojant slaptažodį\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Nepavyko patvirtinti tapatybės slaptažodžius SOCKS serveryje\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "Socks serveris paprašė GSSAPI tapatybės patvirtinimo\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "Socks serveris paprašė tapatybės patvirtinimo slaptažodžiu\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "Socks serveris paprašė tapatybės patvirtinimo\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "Socks serveris paprašė nežinomo tipo %02x tapatybės patvirtinimo\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Prašomas SOCKS tarpinio serverio ryšio į %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Klaida rašant ryšio prašymą į SOCKS tarpinį serverį: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Klaida skaitant jungimosi atsakymą iš SOCKS tarpinio serverio: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 "Nelauktas jungimosi atsakymas iš SOCKS tarpinio serverio: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS tarpinio serverio klaida %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS tarpinio serverio klaida %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Nelauktas adreso tipas %02x SOCKS jungimosi atsakyme\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Prašomas HTTP tarpinio serverio ryšio į %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Tarpinio serverio prašymo siuntimas nepavyko: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Tarpinio serverio CONNECT užklausa nepavyko: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Nežinomas tarpinio serverio tipas „%s“\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Palaikomi tik http arba socks(5) tarpiniai serveriai\n"
 
@@ -1895,16 +1986,28 @@ msgstr "Nežinomas VPN protokolas „%s“\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Sukurta naudojant SSL biblioteką be Cisco DTLS palaikymo\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Nepavyko perskaityti serverio URL „%s“\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Leidžiami tik https:// serverio URL\n"
 
-#: library.c:1015
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Nėra formos apdorotojo; negalima patvirtinti tapatybės.\n"
 
@@ -1920,20 +2023,25 @@ msgstr "Lemtinga klaida komandų eilutės apdorojime\n"
 
 #: main.c:382
 #, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
+#, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() nepavyko: %s\n"
 
-#: main.c:396 main.c:409
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Klaida konvertuojant terminalo įvestį: %s\n"
 
-#: main.c:403 main.c:635
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Nepavyko eilutės iš stdin išskyrimas\n"
 
-#: main.c:570
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1942,21 +2050,21 @@ msgstr ""
 "Pagalbą dirbant su OpenConnect rasite tinklapyje adresu\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:579
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Naudojama OpenSSL. Turimos savybės:"
 
-#: main.c:581
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Naudojama GnuTLS. Turimos savybės:"
 
-#: main.c:590
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL variklio nėra"
 
-#: main.c:622
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -1965,338 +2073,338 @@ msgstr ""
 "\n"
 "ĮSPĖJIMAS: šioje programoje nėra DTLS palaikymo. Našumas bus blogesnis.\n"
 
-#: main.c:659
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:699
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Negalima apdoroti šio vykdomojo failo kelio „%s“"
 
-#: main.c:705
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Nepavyko išskirti vpnc-script keliui\n"
 
-#: main.c:725
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Perrašomas serverio pavadinimas iš „%s“ į „%s“\n"
 
-#: main.c:738
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Naudojimas:  openconnect [parametrai] <serveris>\n"
 
-#: main.c:739
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr "Atverti Cisco AnyConnect VPN klientą, versija %s\n"
 
-#: main.c:741
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Skaityti parametrus iš konfigūracijos failo"
 
-#: main.c:743
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Tęsti fone po paleidimo"
 
-#: main.c:744
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Įrašyti tarnybos PID į šį failą"
 
-#: main.c:746
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Naudoti SSL kliento liudijimą CERT"
 
-#: main.c:747
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Įspėti, kai liudijimo galiojimas < DIENŲ"
 
-#: main.c:748
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Naudoti SSL privataus rakto failą RAKTAS"
 
-#: main.c:749
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Naudoti WebVPN slapuką SLAPUKAS"
 
-#: main.c:750
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Nuskaityti slapuką iš standartinės įvesties"
 
-#: main.c:751
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Įjungti suspaudimą (numatyta)"
 
-#: main.c:752
+#: main.c:766
 msgid "Disable compression"
 msgstr "Išjungti suspaudimą"
 
-#: main.c:753
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Nustatyti mažiausią negyvų porininkų aptikimo intervalą"
 
-#: main.c:754
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Nustatyti prisijungimo naudotojo grupę"
 
-#: main.c:755
+#: main.c:769
 msgid "Display help text"
 msgstr "Rodyti pagalbos tekstą"
 
-#: main.c:756
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Naudoti IFNAME tunelio sąsajai"
 
-#: main.c:758
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Naudoti syslog eigos pranešimams"
 
-#: main.c:760
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Prie eigos pranešimų pridėti laiko žymą"
 
-#: main.c:761
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr "nukopijuoti TOS / TCLASS, kai naudojamas DTLS"
 
-#: main.c:763
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Atsisakyti privilegijų po prisijungimo"
 
-#: main.c:764
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Atsisakyti privilegijų vykdant CSD"
 
-#: main.c:765
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Vykdyti SCENARIJŲ vietoj CSD"
 
-#: main.c:767
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr "Prašyti MTU iš serverio (tik pasenusiems serveriams)"
 
-#: main.c:768
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Nurodyti kelią MTU į/iš serverio"
 
-#: main.c:769
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Nustatyti rakto slaptažodį arba TPM SRK PIN"
 
-#: main.c:770
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Rakto slaptažodis yra failų sistemos fsid"
 
-#: main.c:771
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Nustatyti tarpinį serverį"
 
-#: main.c:772
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Nustatyti tarpinio serverio tapatybės patvirtinimo metodus"
 
-#: main.c:773
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Išjungti tarpinį serverį"
 
-#: main.c:774
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Naudoti libproxy automatiniam tarpinio serverio konfigūravimui"
 
-#: main.c:776
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(PASTABA: libproxy išjungtas šioje programoje)"
 
-#: main.c:778
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Reikalauti tobulo pirminio slaptumo"
 
-#: main.c:779
+#: main.c:793
 msgid "Less output"
 msgstr "Mažiau išvesties"
 
-#: main.c:780
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Nustatyti paketų eilės ribą į LEN paketų"
 
-#: main.c:781
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Apvalkalo komandų eilutė vpnc-suderinamam konfigūracijos scenarijui naudoti"
 
-#: main.c:782
+#: main.c:796
 msgid "default"
 msgstr "numatyta"
 
-#: main.c:784
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Siųsti srautą į „scenarijaus“ programą, ne tun"
 
-#: main.c:786
+#: main.c:800
 msgid "Set login username"
 msgstr "Nustatyti prisijungimo naudotojo vardą"
 
-#: main.c:787
+#: main.c:801
 msgid "Report version number"
 msgstr "Pranešti versijos numerį"
 
-#: main.c:788
+#: main.c:802
 msgid "More output"
 msgstr "Daugiau išvesties"
 
-#: main.c:789
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Įrašyti HTTP tapatybės patvirtinimo srautą (įtraukia --verbose"
 
-#: main.c:790
+#: main.c:804
 msgid "XML config file"
 msgstr "XML konfigūracijos failas"
 
-#: main.c:791
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Pasirinkite tapatybės patvirtinimo prisijungimo pasirinkimą"
 
-#: main.c:792
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Tik patvirtinti tapatybę ir atspausdinti prisijungimo informaciją"
 
-#: main.c:793
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Tik parsisiųsti webvpn slapuką; neprisijungti"
 
-#: main.c:794
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Atspausdinti webvpn slapuką prieš jungiantis"
 
-#: main.c:795
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Liudijimo failas serverio patikrinimui"
 
-#: main.c:796
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Neklausti IPv6 jungimosi"
 
-#: main.c:797
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "OpenSSL šifrais DTLS palaikymui"
 
-#: main.c:798
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Išjungti DTLS"
 
-#: main.c:799
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Išjungti HTTP ryšio pakartotinį naudojimą"
 
-#: main.c:800
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Išjungti slaptažodžio/SecurID tapatybės patvirtinimą"
 
-#: main.c:801
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Nereikalauti, kad serverio SSL liudijimas būtų teisingas"
 
-#: main.c:802
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Išjungti numatytąsias sistemos liudijimų įstaigas"
 
-#: main.c:803
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Nemėginti XML POST tapatybės patvirtinimo"
 
-#: main.c:804
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Nelaukti naudotojo įvesties; išeiti, jei ji būtina"
 
-#: main.c:805
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Skaityti slaptažodį iš standartinės įvesties"
 
-#: main.c:806
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Programinės leksemos tipas: rsa, totp arba hotp"
 
-#: main.c:807
+#: main.c:821
 msgid "Software token secret"
 msgstr "Programinės leksemos paslaptis"
 
-#: main.c:809
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(PASTABA: libstoken (RSA SecurID) išjungta šioje programoje)"
 
-#: main.c:812
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(PASTABA: Yubikey OATH išjungtas šioje programoje)"
 
-#: main.c:814
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Jungimosi pakartotinio bandymo laikas sekundėmis"
 
-#: main.c:815
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Serverio liudijimo SHA1 piršto atspaudas"
 
-#: main.c:816
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP antraštės User-Agent: laukas"
 
-#: main.c:817
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Vietinis vardas, pranešamas serveriui"
 
-#: main.c:818
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Naudoti IP jungiantis prie SERVERIO"
 
-#: main.c:819
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Pranešamas OS tipas (linux,linux-64,win,...)"
 
-#: main.c:820
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Nustatyti vietinį prievadą DTLS datagramoms"
 
-#: main.c:841
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Nepavyko išskirti simbolių eilutės\n"
 
-#: main.c:902
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Nepavyko gauti eilutės iš konfigūracijos failo: %s\n"
 
-#: main.c:942
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Neatpažintas parametras eilutėje %d: „%s“\n"
 
-#: main.c:952
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Parametrui „%s“ nereikia argumento eilutėje %d\n"
 
-#: main.c:956
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Parametrui „%s“ būtinas argumentas eilutėje %d\n"
 
-#: main.c:981
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Netinkamas naudotojas „%s“: %s\n"
 
-#: main.c:991
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "Netinkamas naudotojo ID „%d“: %s\n"
 
-#: main.c:1043
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2307,7 +2415,7 @@ msgstr ""
 "           palaikymo, bet atrodo, kad naudojate seną simbolių\n"
 "           koduotę „%s“. Tikėkitės keistumų.\n"
 
-#: main.c:1050
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2316,42 +2424,42 @@ msgstr ""
 "ĮSPĖJIMAS: Ši openconnect versija yra %s, bet\n"
 "           libopenconnect biblioteka yra %s\n"
 
-#: main.c:1060
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Nepavyko išskirti vpninfo struktūros\n"
 
-#: main.c:1115
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Nepavyko naudoti „config“ parametro konfigūracijos faile\n"
 
-#: main.c:1123
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Nepavyko atverti konfigūracijos failo „%s“: %s\n"
 
-#: main.c:1139
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Netinkama suspaudimo veiksena „%s“\n"
 
-#: main.c:1160
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Trūksta dvitaškio resolve parametre\n"
 
-#: main.c:1165
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Nepavyko išskirti atminties\n"
 
-#: main.c:1245 main.c:1254
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d per mažas\n"
 
-#: main.c:1284
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2361,7 +2469,7 @@ msgstr ""
 "parametro. Jei tai padės, praneškite <openconnect-devel@lists.infradead."
 "org>.\n"
 
-#: main.c:1290
+#: main.c:1304
 #, c-format
 msgid ""
 "The --no-cert-check option was insecure and has been removed.\n"
@@ -2371,125 +2479,125 @@ msgstr ""
 "Pataisykite savo serverio liugijimą arba naudokite --servercert is juo "
 "pasitikėkite.\n"
 
-#: main.c:1307
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Neleidžiamas nulinis eilės ilgis; naudojamas 1\n"
 
-#: main.c:1321
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect versija %s\n"
 
-#: main.c:1354
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Netinkama programinės leksemos veiksena „%s“\n"
 
-#: main.c:1364
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Netinkamas OS identitetas „%s“\n"
 
-#: main.c:1397
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Per daug argumentų komandų eilutėje\n"
 
-#: main.c:1400
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Nenurodytas serveris\n"
 
-#: main.c:1416
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Ši openconnect versija sukurta be libproxy palaikymo\n"
 
-#: main.c:1445
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Klaida atveriant cmd kanalą\n"
 
-#: main.c:1478
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Nepavyko gauti WebVPN slapuko\n"
 
-#: main.c:1499
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Nepavyko sukurti SSL ryšio\n"
 
-#: main.c:1511
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Nepavyko nustatyti DTLS; vietoj to naudojama SSL\n"
 
-#: main.c:1531
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Prisijungta kaip %s%s%s, naudojant %s%s\n"
 
-#: main.c:1540
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Nepateiktas --script argumentas; DNS ir maršrutizavimas nesukonfigūruoti\n"
 
-#: main.c:1542
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Žiūrėkite http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1555
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Nepavyko atverti „%s“ rašymui: %s\n"
 
-#: main.c:1567
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Tęsiama fone; pid %d\n"
 
-#: main.c:1584
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Naudotojas paprašė persijungti\n"
 
-#: main.c:1592
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Persijungiant atmestas slapukas; išeinama.\n"
 
-#: main.c:1596
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Serveris nutraukė seansą; išeinama.\n"
 
-#: main.c:1600
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Naudotojas atsisakė (SIGINT); išeinama.\n"
 
-#: main.c:1604
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Naudotojas atsijungė nuo seanso (SIGHUP); išeinama.\n"
 
-#: main.c:1608
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Nežinoma klaida; išeinama.\n"
 
-#: main.c:1627
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Nepavyko atverti %s rašymui: %s\n"
 
-#: main.c:1635
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Nepavyko įrašyti konfigūracijos į %s: %s\n"
 
-#: main.c:1694
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Serverio SSL liudijimas neatitiko: %s\n"
 
-#: main.c:1713
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2500,7 +2608,7 @@ msgstr ""
 "Liudijimas iš VPN serverio „%s“ nepraėjo patikrinimo.\n"
 "Priežastis: %s\n"
 
-#: main.c:1716
+#: main.c:1730
 #, c-format
 msgid ""
 "To trust this server in future, perhaps add this to your command line:\n"
@@ -2508,94 +2616,94 @@ msgstr ""
 "Norėdami pasitikėti šiuo serveriu ateityje, galite pridėti prie savo komandų "
 "eilutės:\n"
 
-#: main.c:1717
+#: main.c:1731
 #, c-format
 msgid "    --servercert %s\n"
 msgstr "    --servercert %s\n"
 
-#: main.c:1722
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr "Įveskite „%s“ sutikimui, „%s“ nutraukimui; bet ką kitą peržiūrai: "
 
-#: main.c:1723 main.c:1741
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ne"
 
-#: main.c:1723 main.c:1729
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "taip"
 
-#: main.c:1750
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Serverio rakto maišos vertė: %s\n"
 
-#: main.c:1784
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Auth pasirinkimas „%s“ atitinka kelis parametrus\n"
 
-#: main.c:1787
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Auth pasirinkimo „%s“ nėra\n"
 
-#: main.c:1808
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Būtina naudotojo įvestis neinteraktyvioje veiksenoje\n"
 
-#: main.c:1985
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Nepavyko atverti leksemos failo rašymui: %s\n"
 
-#: main.c:1993
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Nepavyko įrašyti leksemos: %s\n"
 
-#: main.c:2039 main.c:2060
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Švelni leksemos eilutė netinkama\n"
 
-#: main.c:2042
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Nepavyko atverti ~/.stokenrc failo\n"
 
-#: main.c:2045
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect nebuvo sukurtas su libstoken palaikymu\n"
 
-#: main.c:2048
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Bendra libstoken klaida\n"
 
-#: main.c:2063
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect nebuvo sukurta su liboath palaikymu\n"
 
-#: main.c:2066
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Bendra liboath klaida\n"
 
-#: main.c:2077
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Yubikey leksema nerasta\n"
 
-#: main.c:2080
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "OpenConnect nebuvo sukurtas su Yubikey palaikymu\n"
 
-#: main.c:2083
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Bendroji Yubikey klaida: %s\n"
@@ -2610,16 +2718,16 @@ msgstr "Nepavyko nustatyti tun scenarijaus\n"
 msgid "Set up tun device failed\n"
 msgstr "Nepavyko nustatyti tun įrenginio\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Kvietėjas pristabdė ryšį\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Nėra darbo; miegama %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "WaitForMultipleObjects nepavyko: %s\n"
@@ -2691,7 +2799,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "Generuojamas OATH TOTP leksemos kodas\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Generuojamas OATH HOTP leksemos kodas\n"
 
@@ -2823,179 +2931,184 @@ msgstr "Gautas KMP pranešimas %d, dydis %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Gautas ne-ESP TLV (grupė %d) ESP prašyme KMP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Klaida kuriant oNCP prašymą\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Per trumpas oNCP prašymas\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Perskaityti %d SSL įrašo baitų\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Laukta %d dydžio atsakymo po serverio paketo\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Serverio atsakymas serverio pavadinimo paketui yra klaida 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Netinkamas paketas laukiant KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Laukas KMP pranešimo 301 iš serverio, bet gauta %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "KMP pranešimas 301 iš serverio yra per didelis (%d baitai)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Gautas KMP pranešimas 301, ilgis %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Nepavyko perskaityti tęsinio įrašo ilgio\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "Papildomų %d baitų įrašymas yra per didelis; būtų %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Nepavyko perskaityti %d ilgio įrašo\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Perskaityti papildomus %d KMP 301 pranešimo baitus\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Klaida apsikeičiant ESP raktais\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "nauji gaunami duomenys"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "nauji siunčiami duomenys"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr "Nepaisoma ESP raktų, kadangi ESP palaikymo nėra šioje versijoje\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Perskaityti tik 1 baito ilgio oNCP lauką\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "Serveris nutraukė ryšį (baigėsi seansas)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "Serveris nutraukė ryšį (priežastis: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "Serveris atsiuntė nulinio ilgio oNCP įrašą\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "Gaunamas KMP pranešimas %d, dydis %d (gauta %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr "Tęsiamas KMP pranešimo %d apdorojimas, dabar dydis %d (gauta %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Neatpažintas duomenų paketas\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Nežinomas KMP pranešimas %d, dydis %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d papildomų baitų gauta\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Išeinantys paketai:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Išsiųsta ESP įjungimo kontrolinis paketas\n"
 
-#: openconnect-internal.h:1064 openconnect-internal.h:1072
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "KLAIDA: %s() iškviesta su netinkamu UTF-8 „%s“ argumentui\n"
 
-#: openssl-dtls.c:134
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
 #, c-format
 msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
 msgstr "Nepavyko sukurti OpenSSL SSL_SESSION ASN.1: %s\n"
 
-#: openssl-dtls.c:145
+#: openssl-dtls.c:227
 msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
 msgstr "OpenSSL nepavyko perskaityti SSL_SESSION ASN.1\n"
 
-#: openssl-dtls.c:159
+#: openssl-dtls.c:241
 msgid "Initialise DTLSv1 session failed\n"
 msgstr "Nepavyko inicializuoti DTLSv1 seanso\n"
 
-#: openssl-dtls.c:188
+#: openssl-dtls.c:270
 msgid "PSK callback\n"
 msgstr ""
 
-#: openssl-dtls.c:205
+#: openssl-dtls.c:287
 msgid "Failed to create app-identity extension for OpenSSL\n"
 msgstr ""
 
-#: openssl-dtls.c:269
+#: openssl-dtls.c:352
 msgid "Initialise DTLSv1 CTX failed\n"
 msgstr "Nepavyko inicializuoti DTLSv1 CTX\n"
 
-#: openssl-dtls.c:282
+#: openssl-dtls.c:365
 msgid "Set DTLS CTX version failed\n"
 msgstr "Nepavyko nustatyti DTLS CTX versijos\n"
 
-#: openssl-dtls.c:299
+#: openssl-dtls.c:382
 msgid "Failed to generate DTLS key\n"
 msgstr ""
 
-#: openssl-dtls.c:319
+#: openssl-dtls.c:402
 msgid "Set DTLS cipher list failed\n"
 msgstr "Nepavyko nustatyti DTLS šifrų\n"
 
-#: openssl-dtls.c:333
+#: openssl-dtls.c:417
 msgid "Not precisely one DTLS cipher\n"
 msgstr "Ne vienintelis DTLS šifras\n"
 
-#: openssl-dtls.c:366
+#: openssl-dtls.c:439
 #, c-format
 msgid ""
 "SSL_set_session() failed with old protocol version 0x%x\n"
@@ -3008,26 +3121,17 @@ msgstr ""
 "Žiūrėkite http://rt.openssl.org/Ticket/Display.html?id=1751\n"
 "Naudokite --no-dtls komandų eilutės parametrą šio pranešimo išvengimui\n"
 
-#: openssl-dtls.c:399
+#: openssl-dtls.c:516
 #, c-format
 msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
 msgstr "Užmezgamas DTLS ryšys (naudojant OpenSSL). Šifrų rinkinys %s.\n"
 
-#: openssl-dtls.c:405
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr "DTLS ryšio suspaudimas, naudojant %s.\n"
-
-#: openssl-dtls.c:436
+#: openssl-dtls.c:553
 msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
 msgstr ""
 "Jūsų OpenSSL yra senesnė, nei naudota kūrimui, todėl DTLS gali nepavykti!"
 
-#: openssl-dtls.c:486 openssl-dtls.c:490
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS rankos paspaudimo laikas baigėsi\n"
-
-#: openssl-dtls.c:487
+#: openssl-dtls.c:604
 msgid ""
 "This is probably because your OpenSSL is broken\n"
 "See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
@@ -3035,7 +3139,7 @@ msgstr ""
 "Taip greičiausiai atsitiko, nes jūsų OpenSSL yra su klaidomis\n"
 "Žiūrėkite http://rt.openssl.org/Ticket/Display.html?id=2984\n"
 
-#: openssl-dtls.c:494
+#: openssl-dtls.c:611
 #, c-format
 msgid "DTLS handshake failed: %d\n"
 msgstr "Nepavyko DTLS rankos paspaudimas: %d\n"
@@ -3135,7 +3239,7 @@ msgstr "Nepavyko rasti PKCS#11 liudijimo „%s“\n"
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "Liudijimo X.509 turinys negautas iš libp11\n"
 
-#: openssl-pkcs11.c:412 openssl.c:728
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Nepavyko įdiegti liudijimo OpenSSL kontekste\n"
 
@@ -3186,259 +3290,259 @@ msgstr "Nepavyko pridėti rakto iš PKCS#11\n"
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Ši OpenConnect versija sukurta be PKCS#11 palaikymo\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Nepavyko rašyti į SSL lizdą\n"
 
-#: openssl.c:184 openssl.c:250
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Nepavyko skaityti iš SSL lizdo\n"
 
-#: openssl.c:279
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "SSL skaitymo klaida %d (serveris greičiausiai užvėrė ryšį); persijungiama.\n"
 
-#: openssl.c:304
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "Nepavyko SSL_write: %d\n"
 
-#: openssl.c:378
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Neapdorotas SSL UI prašymo tipas %d\n"
 
-#: openssl.c:486
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM slaptažodis per ilgas (%d >= %d)\n"
 
-#: openssl.c:519
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Papildomas liudijimas iš %s: „%s“\n"
 
-#: openssl.c:569
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Nepavyko perskaityti PKCS#12 (žiūrėkite klaidas aukščiau)\n"
 
-#: openssl.c:584
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 neturėjo liudijimo!\n"
 
-#: openssl.c:593
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 neturėjo privataus rakto!\n"
 
-#: openssl.c:598
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:616
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Nepavyksta įkelti TPM variklio.\n"
 
-#: openssl.c:622
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Nepavyko inicializuoti TPM variklio\n"
 
-#: openssl.c:632
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Nepavyko nustatyti TPM SRK slaptažodžio\n"
 
-#: openssl.c:646
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Nepavyko įkelti TPM privataus rakto\n"
 
-#: openssl.c:652
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Nepavyko pridėti rakto iš TPM\n"
 
-#: openssl.c:702 openssl.c:850
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Nepavyko atverti liudijimo failo %s: %s\n"
 
-#: openssl.c:712
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Nepavyko įkelti liudijimo\n"
 
-#: openssl.c:750
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr "Nepavyko apdoroti visų palaikomų liudijimų. Vis tiek bandoma...\n"
 
-#: openssl.c:763
+#: openssl.c:776
 msgid "PEM file"
 msgstr "PEM failas"
 
-#: openssl.c:792
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Nepavyko sukurti BIO iš įvesties elemento „%s“\n"
 
-#: openssl.c:817
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Nepavyko įkelti privataus rakto (neteisingas slaptažodis?)\n"
 
-#: openssl.c:823
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Nepavyko įkelti privataus rakto (žiūrėkite klaidas aukščiau)\n"
 
-#: openssl.c:873
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Nepavyko įkelti X509 liudijimo iš įvesties\n"
 
-#: openssl.c:879
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Nepavyko naudoti X509 liudijimo iš įvesties\n"
 
-#: openssl.c:911
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Nepavyko naudoti privataus rakto iš įvesties\n"
 
-#: openssl.c:927
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Nepavyko atverti privataus rakto failo %s: %s\n"
 
-#: openssl.c:947 openssl.c:962 openssl.c:983 openssl.c:1049
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Nepavyko įkelti privataus rakto\n"
 
-#: openssl.c:1043
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr "Nepavyko konvertuoti PKCS#8 į OpenSSL EVP_PKEY\n"
 
-#: openssl.c:1060
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Nepavyko identifikuoti privataus rakto tipas iš „%s“\n"
 
-#: openssl.c:1222
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Atitikęs DNS alternatyvus vardas „%s“\n"
 
-#: openssl.c:1229
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Nėra atitikmenų alternatyviam vardui „%s“\n"
 
-#: openssl.c:1243
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Liudijimas turi blogo ilgio %d GEN_IPADD alternatyvų vardą\n"
 
-#: openssl.c:1254 openssl.c:1400
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Atitiko %s adresas „%s“\n"
 
-#: openssl.c:1261
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Nėra atitikmens %s adresui „%s“\n"
 
-#: openssl.c:1303
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI „%s“ turi netuščia kelia; nepaisoma\n"
 
-#: openssl.c:1308
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Atitiko URI „%s“\n"
 
-#: openssl.c:1319
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Nėra atitikmens URI „%s“\n"
 
-#: openssl.c:1334
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Nėra alternatyvaus vardo porinio liudijimo atitikime „%s“\n"
 
-#: openssl.c:1342
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Nėra subjekto vardo poriniame liudijime!\n"
 
-#: openssl.c:1362
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Nepavyko perskaityti subjekto poriniame liudijime\n"
 
-#: openssl.c:1369
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Porinio liudijimo neatitikimas ('%s' != '%s')\n"
 
-#: openssl.c:1374 openssl.c:1408
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Atitikęs porinio liudijimo subjekto vardas „%s“\n"
 
-#: openssl.c:1470
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Papildomas liudijimas iš cafile: „%s“\n"
 
-#: openssl.c:1608
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Klaida kliento liudijimo notAfter lauke\n"
 
-#: openssl.c:1621
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<klaida>"
 
-#: openssl.c:1674
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr "Nepavyko sukurti TLSv1 CTX\n"
 
-#: openssl.c:1693
+#: openssl.c:1705
 msgid "SSL certificate and key do not match\n"
 msgstr "SSL liudijimas ir raktas nesutampa\n"
 
-#: openssl.c:1738
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Nepavyko perskaityti liudijimų iš LĮ failo „%s“\n"
 
-#: openssl.c:1771
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Nepavyko atverti LĮ failo „%s“\n"
 
-#: openssl.c:1831
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL ryšio klaida\n"
 
-#: openssl.c:1992
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Nepavyko suskaičiuoti OATH HMAC\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Išmetamas blogas padalinimas įtraukia: „%s“\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Išmetamas blogas padalinimas neįtraukia: „%s“\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Nepavyko paleisti scenarijaus „%s“ %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Scenarijus „%s“ išėjo nenormaliai (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Scenarijus „%s“ grąžino klaidą %d\n"
@@ -3738,84 +3842,96 @@ msgstr "Netinkamas PIN formatas; bandykite dar kartą.\n"
 msgid "Generating RSA token code\n"
 msgstr "Generuojamas RSA leksemos kodas\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Klaida prieinant prie registro rakto tinklo adapteriams\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Nepaisoma neatitinkančios TAP sąsajos „%s“\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Rasti ne Windows-TAP adapteriai. Ar tvarkyklė įdiegta?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Nepavyko atverti %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Atvertas tun įrenginys %s\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Nepavyko gauti TAP tvarkyklės versijos: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Klaida: reikalinga TAP-Windows tvarkylė v9.9  arba naujesnė (rasta %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Nepavyko nustatyti TAP IP adresų: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Nepavyko nustatyti TAP laikmenos būsenos: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "TAP įrenginys atmetė ryšį. Atsijungiama.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Nepavyko skaityti iš TAP įrenginio: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Nepavyko skaityti iš TAP įrenginio: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Į tun įrašyta %ld baitų\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Laukiama tun rašymui...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Po laukimo į tun įrašyta %ld baitų\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Nepavyko rašyti į TAP įrenginį: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Tunelio scenarijų paleidimas Windows aplinkoje dar nepalaikomas\n"
 
@@ -4122,39 +4238,3 @@ msgstr "skaičiavimo komanda"
 #: yubikey.c:608
 msgid "Unrecognised response from Yubikey when generating tokencode\n"
 msgstr "Neatpažintas atsakymas iš Yubikey generuojant leksemos kodą\n"
-
-#~ msgid "SSL operation cancelled\n"
-#~ msgstr "SSL veiksmas nutrauktas\n"
-
-#~ msgid "Too long time in MTU detect loop; bailing out.\n"
-#~ msgstr "Per ilgas MTU aptikimo ciklas; nutraukiama.\n"
-
-#~ msgid "Failed to send DPD request (%d): %s\n"
-#~ msgstr "Nepavyko išsiųsti DPD užklausos (%d): %s\n"
-
-#~ msgid "Failed to recv DPD request (%d): %s\n"
-#~ msgstr "Nepavyko gauti DPD užklausos (%d): %s\n"
-
-#~ msgid "using OpenSSL"
-#~ msgstr "naudojama OpenSSL"
-
-#~ msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-#~ msgstr "(Ar ugniasienė neleidžia jums siųsti UDP paketų?)\n"
-
-#~ msgid "DTLS handshake failed: %s\n"
-#~ msgstr "Nepavyko DTLS rankos paspaudimas: %s\n"
-
-#~ msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-#~ msgstr "Užmegztas DTLS ryšys (naudojant GnuTLS). Šifrų rinkinys %s.\n"
-
-#~ msgid "Failed to set DTLS MTU: %s\n"
-#~ msgstr "Nepavyko nustatyti DTLS MTU: %s\n"
-
-#~ msgid "Failed to set DTLS session parameters: %s\n"
-#~ msgstr "Nepavyko nustatyti DTLS sesijos prametrų: %s\n"
-
-#~ msgid "Failed to set DTLS priority: %s\n"
-#~ msgstr "Nepavyko nustatyti DTLS prioriteto: %s\n"
-
-#~ msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-#~ msgstr "Nežinomi DTLS parametrai prašomam CipherSuite „%s“\n"
diff --git a/po/lv.po b/po/lv.po
index d59c0877..0a171c80 100644
--- a/po/lv.po
+++ b/po/lv.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Latvian (http://www.transifex.net/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/mai.po b/po/mai.po
index 3248829a..9f26909a 100644
--- a/po/mai.po
+++ b/po/mai.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Maithili (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/mg.po b/po/mg.po
index 322297ff..134dbddb 100644
--- a/po/mg.po
+++ b/po/mg.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Malagasy (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/mk.po b/po/mk.po
index 073c6421..855c1594 100644
--- a/po/mk.po
+++ b/po/mk.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Macedonian (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ml.po b/po/ml.po
index 562fff15..aa3f53b3 100644
--- a/po/ml.po
+++ b/po/ml.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Malayalam (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/mn.po b/po/mn.po
index b8608239..fdaac430 100644
--- a/po/mn.po
+++ b/po/mn.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Mongolian (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/mr.po b/po/mr.po
index 7a460a11..aba58790 100644
--- a/po/mr.po
+++ b/po/mr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: network-manager-openconnect.HEAD\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2009-03-04 18:40+0530\n"
 "Last-Translator: Sandeep Shedmake <sandeep.shedmake@gmail.com>\n"
 "Language-Team: marathi\n"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ms.po b/po/ms.po
index 33823893..f7d6c82a 100644
--- a/po/ms.po
+++ b/po/ms.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Malay (http://www.transifex.net/projects/p/meego/team/ms/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ms_MY.po b/po/ms_MY.po
index 10117a28..254cd359 100644
--- a/po/ms_MY.po
+++ b/po/ms_MY.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Malay (Malaysia) (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/nb.po b/po/nb.po
index e9535e9a..c166ab64 100644
--- a/po/nb.po
+++ b/po/nb.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Norwegian Bokmål (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/nds.po b/po/nds.po
index 0674b30d..c980958a 100644
--- a/po/nds.po
+++ b/po/nds.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Low German (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ne.po b/po/ne.po
index 95dff8bf..ba691b86 100644
--- a/po/ne.po
+++ b/po/ne.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Nepali (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/nl.po b/po/nl.po
index b1bfa780..885b43a7 100644
--- a/po/nl.po
+++ b/po/nl.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-12-20 19:06+0000\n"
 "Last-Translator: André Koot <meneer@tken.net>\n"
 "Language-Team: Dutch (http://www.transifex.com/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr "Vroeg naar wachtwoord, maar '- no-passwd' is ingesteld\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Kan geen HTTPS-verbinding openen met %s\n"
@@ -304,547 +304,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Fout bij het ophalen HTTPS reactie\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN-service niet beschikbaar, reden:%s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Onjuiste HTTP CONNECT reactie: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "CONNECT reactie: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Geen geheugen voor opties\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID niet 64 tekens; is: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Onbekende CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Geen MTU ontvangen. Afbreken\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Geen IP-adres ontvangen. Afbreken\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Herverbinden gaf verschillende Legacy IP-adressen (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Herverbinden gaf verschillende Legacy IP-netmasks (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Herverbinden gaf verschillende IP-adressen (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Herverbinden gaf verschillende IPv6-netmasks (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP aangesloten. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Compressie setup is mislukt\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Toewijzing van leegloop buffer is mislukt\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "decomprimeren mislukt\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "compressie mislukt %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Onverwachte pakket lengte. SSL_read meldde %d, maar pakket is\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Ontvangen CSTP DPD aanvraag\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Ontvangen CSTP DPD reactie\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Ontvangen CSTP Keepalive\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Ontvangen datapakket ongecomprimeerd %d bytes\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Ontvangen servermelding ontkoppeling: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Gecomprimeerd pakket ontvangen in !deflate mode\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "ontvangen server beëindigingspakket\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Onbekend packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL schreef te weinig bytes! Gevraagd om %d, verstuurde %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP rekey verwacht\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTP Dead Peer Detection ontdekte dode host!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Herverbinden mislukte\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Stuur CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Stuur CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Verzenden van gedecomprimeerd datapakket van %d bytes\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Stuur BYE pakket: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Initialiseren DTLSv1 sessie is mislukt\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Initialiseren DTLSv1 CTX is mislukt\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Instellen DTLS cipher lijst is mislukt\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Niet precies één DTLS cipher\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session () is mislukt met oude protocol versie 0x%x\n"
-"Gebruikt u een versie van OpenSSL ouder dan 0.9.8m?\n"
-"Zie http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Gebruik de - no-dtls commandoregel optie om dit bericht te voorkomoen\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Uw OpenSSL is ouder dan de versie die voor uw build nodig is, dus DTLS kan "
-"mislukken!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS handshake time-out\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS handshake mislukt: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Onbekende DTLS parameters voor aangevraagde CipherSuite '%s'\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Niet geslaagd in instellen DTLS prioriteit: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Niet geslaagd in instellen DTLS sessie parameters: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Instellen DTLS MTU mislukt: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "DTLS handshake mislukt: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Geen DTLS adres\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Server bood geen DTLS cipher optie aan\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Geen DTLS wanneer deze is aangesloten via een proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS optie %s:%s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Probeer nieuwe DTLS verbinding\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Ontvangen DTLS pakket 0x%02x van %d bytes\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Ontving DTLS DPD aanvraag\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Mislukt om DPD reactie te versturen. Verwacht ontkoppeling\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Ontving DTLS DPD reactie\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Ontving DTLS Keepalive\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Onbekend DTLS pakkettype %02x, len %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS rekey verwacht\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS Dead Peer Detection ontdekte dode host!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Stuur DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Niet geslaagd in verzenden DPD aanvraag. Verbinding wordt verbroken\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Stuur DTLS Keepalive\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Onbekend pakket (len %d) ontvangen: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS kreeg schrijffout %d. Terugvallen naar SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS kleerg schrijffout: %s. Terugvallen naar SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Verstuurd DTLS packet van %d bytes; DTLS verzending retourneerde %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgstr ""
+
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Timeout while waiting for DPD response; trying %d\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
+
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -946,6 +879,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Onbekende DTLS parameters voor aangevraagde CipherSuite '%s'\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Niet geslaagd in instellen DTLS prioriteit: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Niet geslaagd in instellen DTLS sessie parameters: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Instellen DTLS MTU mislukt: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS handshake time-out\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "DTLS handshake mislukt: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -966,7 +990,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -985,7 +1009,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Schrijven SSL geannuleerd\n"
 
@@ -994,487 +1018,491 @@ msgstr "Schrijven SSL geannuleerd\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Schrijven naar SSL socket mislukt: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL lezen geannuleerd\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Lezen van SSL socket mislukt: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "SSL leesfout: %s; herverbinden.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "SSL versturen mislukt: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Kon de vervaldatum niet afleiden uit het certificaat\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Client certificaat is verlopen op"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Client certificaat vervalt al snel op"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Openen sleutel/certificaat bestand %s: %s mislukt\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Toewijzen certificaat bufferruimte mislukt\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "In geheugen inlezen van certificaat info mislukt: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Instellen van PKCS#12 gegevensstructuur mislukt: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Ontcijferen PKCS#12 certificaatbestand mislukt\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Invoeren PKCS#12 wachtwoord:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Verwerken PKCS#12 bestand mislukt: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Laden PKCS#12 certificaat mislukt: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Importeren X509 certificaat mislukte: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Instellen PKCS#11 certificaat mislukte: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Kon de MD5 hash niet initialiseren: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "MD5 hash error: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Kan PEM versleutelingstype niet achterhalen\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Niet-ondersteunde PEM versleutelingstype: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Ongeldige salt in versleuteld PEM bestand\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Fout base64-decoderen versleutelde PEM bestand: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "versleutelde PEM bestand te kort\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Niet gelukt om PEM key %s te ontcijferen\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Ontcijferen PEM sleutel mislukt\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Invoeren PEM wachtwoord:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Deze binary is gecompileerd zonder PKCS#11 ondersteuning\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Gebruikmaken van PKCS#11 certificaat %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Fout bij het laden van het certificaat van PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Gebruiken van certificatenbestand %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "PKCS#11 bestand bevat geen certificaat\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Geen certificaat gevonden in bestand"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Laden van het certificaat mislukt: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Fout bij initialiseren privésleutel structuur: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Fout bij initialiseren PKCS#11 sleutel structuur: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Fout bij importeren PKCS#11 URL %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "gebruikt PKCS#11 sleutel %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Fout bij importeren PKCS#11 sleutel in privésleutel structuur: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Gebruik geheime sleutel bestand %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Deze versie van OpenConnect werd gebouwd zonder TPM ondersteuning\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Interpreteren PEM bestand mislukt\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Laden PKCS#1 privésleutel mislukt: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Laden van privésleutel als PKCS#8 mislukt: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Ontcijferen PKCS#8 certificaatbestand mislukt\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Invoeren PKCS#8 wachtwoord:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Niet gelukt in ophalen sleutel ID: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Fout bij ondertekenen test data met geheime sleutel: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Fout bij valideren handtekening tegen certificaat: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Geen SSL certificaat gevonden dat past bij de private key\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Gebruiken client certificaat '%s'\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Instellen van de certificate revocation list mislukte: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "WAARSCHUWING: GnuTLS retourneerde onjuiste uitgever certs; authenticatie kan "
 "mislukken!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Toewijzen van geheugen voor ondersteunen certificaatfuncties mislukt\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Toevogen ondersteunde CA '%s'\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Instellen certificaat mislukt: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Server presenteerde geen certificaat\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Fout bij initialiseren X509 cert structuur\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Fout bij importeren server cert\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Fout bij controleren cert status\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certificaat ingetrokken"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "ondertekenaar niet gevonden"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "ondertekenaar geen CA certificaat"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "onveilig algorithme"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certificaat nog niet geactiveerd"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certificaat verlopen"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "handtekeningverificatie mislukt"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certificaat komt niet overeen met hostnaam"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Servercertificaat verificatie mislukt: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Niet geslaag in lezen certs van cafile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Open CA bestand '%s' mislukt: %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Laden van certificaat is mislukt. Afbreken.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL afstemmen met %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL verbinding geannuleerd\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL verbindingsfout: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Verbonden met HTTPS op %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN nodig voor %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Verkeerde PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Dit is de laatste poging voor blokkeren!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Nog maar een paar pogingen voor blokkeren!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Invoeren PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1668,7 +1696,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1686,236 +1714,236 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Geen geheugen voor de toewijzing van cookies\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Mislukte poging HTTP reactie '%s' te ontleden\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Ontving HTTP reactie: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Fout bij de verwerking van HTTP-reactie\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Onbekende HTTP response lijn '%s' genegeerd\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Ongeldige koekje aangeboden: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL certificaat authenticatie mislukt\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Reactie heeft negatieve grootte (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Onbekend Transfer-Encoding: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP body %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Fout bij het lezen van HTTP reactie\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Fout bij het ophalen brok header\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Fout bij het ophalen HTTP reactietekst\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Fout in chunked decodering. Verwacht '', ontving: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 "Kan HTTP 1.0 content niet ontvangen zonder het sluiten van de verbinding\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Niet geslaagd om doorgestuurd URL '%s' te vertalen: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Kan niet doorverwijzen naar non-https URL '%s'\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Toewijzing van nieuwe pad voor de relatieve redirect is mislukt: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Onverwacht %d resultaat van de server\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "verzoek ingewilligd"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "algemene storing"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "verbinding niet toegestaan ​​door regelset"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "netwerk onbereikbaar"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "host onbereikbaar"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "verbinding geweigerd door doelhost"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL verlopen"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "commando niet ondersteund / protocol fout"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "adres type niet ondersteund"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Fout bij het schrijven auth verzoek aan SOCKS proxy: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Fout bij het lezen van auth reactie van SOCKS proxy: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Onverwachte auth reactie van SOCKS proxy: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Het aanvragen van SOCKS proxy verbinding met %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Fout bij het schrijven verbindingsverzoek aan SOCKS proxy: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Fout bij het lezen van verbindingsreactie van SOCKS proxy: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Onverwachte verbindingsreactie van SOCKS proxy: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS proxy fout %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS proxy fout %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Onverwacht adres type %02x in SOCKS aansluitreactie\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Aanvragen van HTTP-proxy verbinding met %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Het verzenden van het proxy verzoek is mislukt: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Onbekend proxy-type '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Alleen http of socks(5) proxies ondersteund\n"
 
@@ -1928,45 +1956,62 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Gecompileerd met een SSL library zonder Cisco DTLS ondersteuning\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Fout bij ontleden server-URL '%s'\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Alleen https:// toegestaan ​​voor server-URL\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Geen formulier afhandelaar; kon niet authenticeren.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Mislukte toewijzing voor string vanaf stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1975,25 +2020,21 @@ msgstr ""
 "Voor hulp bij OpenConnect, bezoek de website op/n\n"
 "  http://www.infradead.org/openconnect/mail.html/n\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Gebruik OpenSSL. Functionaliteiten:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Gebruiken GnuTLS. Functionatiteiten:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL ENGINE niet aanwezig"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "gebruikmaken van OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2003,338 +2044,338 @@ msgstr ""
 "LET OP: Geen DTLS ondersteuning on deze binary. Prestaties worden "
 "beïnvloed.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Gebruik: openconnect [opties] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr "Open-client voor Cisco AnyConnect VPN, versie %s\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Haal opties uit configuratiebestand"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Ga na het opstarten verder op de achtergrond"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Schrijf de daemons pid naar dit bestand"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Gebruik SSL-client-certificaat CERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Waarschuwen wanneer certificaat levensduur < DAGEN"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Gebruik SSL private key bestand KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Gebruik WebVPN Cookie Cookie"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Lees de cookie van de standaard invoer"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Activeer compressie (standaard)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Deactiveer compressie"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Instellen minimale Dead Peer Detection interval"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Instellen login gebruikersgroep"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Weergeven helptekst"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Gebruik ifname voor tunnel-interface"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Gebruik syslog voor voorgangsberichten"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Laat privileges vallen na verbinden"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Laat privileges valllen tijdens CSD uitvoering"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Run script in plaats van CSD binairy"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Aangeven pad MTU van/naar server"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Instellen wachtwoord van TPM SRK PIN"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Sleutelwoord is fsid van het bestandssysteem"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Instellen proxyserver"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Deactiveren proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Gebruik libproxy om de proxy automatisch te configureren"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NB: libproxy uitgeschakeld in deze build)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Minder output"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Instellen maximale packet lengte tot LEN pkts"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Shell command oregel voor het gebruik van een vpnc-compatibele config script"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "standaard"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Leidt het verkeer naar 'script' programma, niet tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Instellen login gebruikersnaam"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Rapporteer versienummer"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Meer output"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML-configuratiebestand"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Kies authenticatie login selectie"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Alleen authenticeren en tonen inloginformatie"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Ophalen van alleen webvpn cookie, niet verbinden"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Print webvpn koekje voor het verbinden"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Cert file voor serververificatie"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Vraag niet om IPv6-connectiviteit"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "OpenSSL sleutels voor ondersteuning van DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Deactiveren DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Deactiveer hergebruiken HTTP-verbinding"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Deactiveren wachtwoord / SecurID-authenticatie"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Geen geldig server SSL cert vereist"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Verwacht geen invoer van de gebruiker, exit als het nodig is"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Lees wachtwoord van standaardinvoer"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Opnieuw proberen verbindingstime-out in seconden"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "SHA1 vingerafdruk servercertificaat"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP header User-agent: veld"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Instellen lokale poort voor DTLS datagrams"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Mislukt om regel %s uit het configuratiebestand te halen\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Niet herkende optie in regel %d: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Optie '%s' heeft geen argument in regel %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Optie '%s' heeft een argument nodig in regel %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2342,7 +2383,7 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2351,42 +2392,42 @@ msgstr ""
 "Waarschuwing: De versie van openconnect is %s maar de\n"
 "              versie van de libopenconnect library is %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Niet gelukt vpninfo structuur toe te wijzen\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Kan de 'config' optie in het configuratiebestand niet gebruiken\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Kan niet openen configuratiebestand '%s': %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d te klein\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2396,126 +2437,133 @@ msgstr ""
 "keepalive optie.\n"
 "Als dit helpt, meldt u zich bij <openconnect-devel@lists.infradead.org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "0-lengte van de wachtrij niet toegestaan, gebruik 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect versie %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Ongeldige OS identiteit \"%s\"\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Te veel argumenten in de commandoregel\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Geen server opgegeven\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 "Deze versie van openconnect werd gebouwd zonder libproxy ondersteuning\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Niet gelukt WebVPN cookie te verkrijgen\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Het maken van SSL-verbinding is mislukt\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Instellen DTLS mislukt, gebruik SSL in plaats daarvan\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "No --script argument meegegeven; DNS en routering zijn niet geconfigureerd\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Bekijk http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Niet gelukt '%s' te openen voor schrijven: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Voortgezet in achtergrond; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Niet gelukt %s te openen voor schrijven: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Niet gelukt config te schrijven naar %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Server SSL certificaat komt niet overeen: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2526,93 +2574,104 @@ msgstr ""
 "Certificaat van VPN-server \"%s\" verificatie mislukt.\n"
 "Reden: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Invoeren '%s' om te accepteren, '%s' om af te breken; iets anders om te "
 "bekijken: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "nee"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "ja"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Auth keuze \"%s\" niet beschikbaar\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Gebruikersinvoer vereist in niet-interactieve modus\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Soft token string is ongeldig\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 "Kan ~/.stokenrc bestand niet openen\n"
 "\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Algemene fout in libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2627,16 +2686,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr "Instellen tun apparaat is mislukt\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Niets te doen, slapen %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2702,7 +2761,7 @@ msgstr "Server weigert soft token; omschakelen naar handmatige invoer\n"
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2834,503 +2893,618 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Initialiseren DTLSv1 sessie is mislukt\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Initialiseren DTLSv1 CTX is mislukt\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Instellen DTLS cipher lijst is mislukt\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Niet precies één DTLS cipher\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session () is mislukt met oude protocol versie 0x%x\n"
+"Gebruikt u een versie van OpenSSL ouder dan 0.9.8m?\n"
+"Zie http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Gebruik de - no-dtls commandoregel optie om dit bericht te voorkomoen\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Uw OpenSSL is ouder dan de versie die voor uw build nodig is, dus DTLS kan "
+"mislukken!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS handshake mislukt: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Schrijven naar SSL socket mislukt\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Kon niet lezen van de SSL socket\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "SSL lezen fout %d (serververbinding waarschijnlijk gesloten); opnieuw "
 "aansluiten.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write is mislukt: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM wachtwoord te lang (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Extra cert van %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Ontleden PKCS # 12 mislukt (zie bovenstaande fouten)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS # 12 bevatte geen certificaat!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS # 12 bevatte geen privé-sleutel!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Kan TPM engine niet laden.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Niet geslaagd om TPM engine te initiëren\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Niet geslaagd om TPM SRK wachtwoord in te stellen\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Niet geslaagd om TPM private sleutel te laden\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Toevoegen sleutel van TPM is mislukt\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Niet geslaagd om certificatenbestand %s te openen: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Laden van certificaat is mislukt\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Het laden van private sleutel is mislukt (verkeerde wachtwoord?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Het laden van private sleutel is mislukt (zie bovenstaande fouten)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Laden X509 certificaat uit keystore mislukt\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Gebruik van X509 certificaat uit keystore mislukt\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Gebruik van privésleutel uit keystore mislukt\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Niet geslaagd in het openen van private key bestand %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Niet geslaag in vaststellen private sleutel type in '%s'\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Overeenkomstige DNS altname '%s'\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Geen overeenkomstige altname '%s'\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Certificaat heeft GEN_IPADD altname met pseudo-lengte %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Overeenkomstig %s adres '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Geen overeenkomstig %s adres %s\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' heeft geen leeg pad; negeren\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Overeenkomstige URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Geen overeenkomst met URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Geen altname in peer-cert overeenkomstig met '%s'\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Geen onderwerp naam in peer-cert!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Niet gelukt om onderwerpnaam in peer-cert te ontleden\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Peer cert onderwerp mismatch ('%s'! = '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Overeenkomstig peer-certificaat onderwerpnaam '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Extra cert van CAFile: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Fout in client cert notAfter veld\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Inlezen van certs van CA bestand mislukt '%s'\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Niet gelukt om CA bestand '%s' te openen\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL-verbinding niet geslaagd\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Negeren slechte split waaronder: ​​\"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Negeren slechte split zonder: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Niet gelukt om script '%s' te starten voor %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Script '%s' eindigde abnormaal (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Script '%s' retourneerde fout %d\n"
@@ -3627,83 +3801,95 @@ msgstr "Ongeldig PIN formaat; probeer het nogmaals.\n"
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/nn.po b/po/nn.po
index 166130f5..6a9e7161 100644
--- a/po/nn.po
+++ b/po/nn.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Norwegian Nynorsk (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/no.po b/po/no.po
index c24efeb3..8a8f985f 100644
--- a/po/no.po
+++ b/po/no.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Norwegian (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/nqo.po b/po/nqo.po
index dd471c13..82ec00ab 100644
--- a/po/nqo.po
+++ b/po/nqo.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: N'ko (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/nso.po b/po/nso.po
index 6d5c2e09..68035ab0 100644
--- a/po/nso.po
+++ b/po/nso.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Northern Sotho (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/oc.po b/po/oc.po
index 66daa5db..c756e061 100644
--- a/po/oc.po
+++ b/po/oc.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Occitan (post 1500) (http://www.transifex.com/projects/p/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/or.po b/po/or.po
index 7cfef2dd..f56c963d 100644
--- a/po/or.po
+++ b/po/or.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: or\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-03-04 16:30+0530\n"
 "Last-Translator: Manoj Kumar Giri <mgiri@redhat.com>\n"
 "Language-Team: Oriya <oriya-it@googlegroups.com>\n"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/pa.po b/po/pa.po
index d717c3d8..20f8c590 100644
--- a/po/pa.po
+++ b/po/pa.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Panjabi (Punjabi) <punjabi-users@lists.sf.net>\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "ਸਰਟੀਫਿਕੇਟ ਸੈੱਟ ਕਰਨ ਲਈ ਫੇਲ੍ਹ: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "ਸਰਟੀਫਿਕੇਟ ਵਾਪਸ ਲਿਆ"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "ਦਸਤਖਤੀ ਨਹੀਂ ਲੱਭਿਆ"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "ਅਸੁਰੱਖਿਅਤ ਐਲੋਗਰਿਥਮ"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "ਸਰਟੀਫਿਕੇਟ ਹਾਲੇ ਐਕਟੀਵੇਟ ਨਹੀਂ ਹੈ"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "ਸਰਟੀਫਿਕੇਟ ਮਿਆਦ ਪੁੱਗੀ"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "ਦਸਤਖਤ ਜਾਂਚ ਫੇਲ੍ਹ ਹੋਈ"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL ਕੁਨੈਕਸ਼ਨ ਫੇਲ੍ਹ ਹੋਇਆ: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "%s ਲਈ ਪਿੰਨ ਚਾਹੀਦਾ ਹੈ"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "ਗਲਤ ਪਿੰਨ"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "PIN ਦਿਓ:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "ਅਣਜਾਣ ਟਰਾਂਸਫਰ-ਇੰਕੋਡਿੰਗ: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP ਮੁੱਖ ਭਾਗ %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "ਆਮ ਫੇਲ੍ਹ"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "ਨੈੱਟਵਰਕ ਪਹੁੰਚ 'ਚ ਨਹੀਂ"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "ਹੋਸਟ ਪਹੁੰਚ 'ਚ ਨਹੀਂ"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL ਮਿਆਦ ਪੁੱਗੀ"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "ਪਰੋਟੋਕਾਲ ਟਾਈਪ ਸਹਾਇਕ ਨਹੀਂ ਹੈ"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS ਪਰਾਕਸੀ ਗਲਤੀ %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS ਪਰਾਕਸੀ ਗਲਤੀ %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "ਅਣਜਾਣ ਪਰਾਕਸੀ ਕਿਸਮ '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "OpenSSL ਦੀ ਵਰਤੋਂ। ਮੌਜੂਦਾ ਫੀਚਰ:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "GnuTLS ਦੀ ਵਰਤੋਂ। ਮੌਜੂਦਾ ਫੀਚਰ:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL ਇੰਜਣ ਮੌਜੂਦ ਨਹੀਂ"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "OpenSSL ਦੀ ਵਰਤੋਂ"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "ਵਰਤੋਂ:  openconnect [options] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "ਕੰਪਰੈਸ਼ਨ ਵਰਤੋਂ (ਡਿਫਾਲਟ)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "ਕੰਪਰੈਸ਼ਨ ਆਯੋਗ"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "ਲਾਗਇ ਯੂਜ਼ਰ-ਗਰੁੱਪ ਸੈੱਟ ਕਰੋ"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "ਮੱਦਦ ਟੈਕਸਟ ਵੇਖਾਓ"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "ਤਰੱਕੀ ਸੁਨੇਹਿਆਂ ਲਈ syslog ਵਰਤੋਂ"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "ਘੱਟ ਆਉਟਪੁੱਟ"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "ਡਿਫਾਲਟ"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "ਲਾਗਇਨ ਯੂਜ਼ਰ-ਨਾਂ ਸੈੱਟ ਕਰੋ"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "ਵਰਜਨ ਨੰਬਰ ਰਿਪੋਰਟ ਕਰੋ"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "ਹੋਰ ਆਉਟਪੁੱਟ"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML ਸੰਰਚਨਾ ਫਾਇਲ"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "ਸਰਵਰ ਜਾਂਚ ਲਈ ਸਰਟ ਫਾਇਲ"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "DTLS ਆਯੋਗ"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "HTTP ਕੁਨੈਕਸ਼ਨ ਮੁੜ-ਵਰਤਣਾ ਆਯੋਗ"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "ਸਟੈਂਡਰਡ ਆਉਟਪੁੱਟ ਤੋਂ ਪਾਸਵਰਡ ਪੜ੍ਹੋ"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "'%s' ਸੰਰਚਨਾ ਫਾਇਲ ਨੂੰ ਖੋਲ੍ਹਿਆ ਨਹੀਂ ਜਾ ਸਕਦਾ: %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d ਬਹੁਤ ਛੋਟਾ ਹੈ\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect ਵਰਜਨ %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "ਕਮਾਂਡ ਲਾਈਨ ਲਈ ਬਹੁਤ ਸਾਰੇ ਆਰਗੂਮੈਂਟ\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "ਕੋਈ ਸਰਵਰ ਨਹੀਂ ਦਿੱਤਾ\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "WebVPN ਕੂਕੀਜ਼ ਲੈਣ ਲਈ ਫੇਲ੍ਹ\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "SSL ਕੁਨੈਕਸ਼ਨ ਬਣਾਉਣ ਲਈ ਫੇਲ੍ਹ\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "DTLS ਸੈਟਅੱਪ ਲਈ ਫੇਲ੍ਹ; ਇਸ ਦੀ ਬਜਾਏ SSL ਵਰਤੋਂ\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "http://www.infradead.org/openconnect/vpnc-script.html ਵੇਖੋ\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "'%s ਨੂੰ ਲਿਖਣ ਲਈ ਖੋਲ੍ਹਣ ਵਾਸਤੇ ਫੇਲ੍ਹ: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "ਬੈਕਗਰਾਊਂਡ ਵਿੱਚ ਜਾਰੀ; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "%s ਨੂੰ ਲਿਖਣ ਲਈ ਖੋਲ੍ਹਣ ਵਾਸਤੇ ਫੇਲ੍ਹ: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "%s ਲਈ ਸੰਰਚਨਾ ਫਾਇਲ ਲਿਖਣ ਲਈ ਫੇਲ੍ਹ: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ਨਹੀਂ"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "ਹਾਂ"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<ਗਲਤੀ>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL ਕੁਨੈਕਸ਼ਨ ਫੇਲ੍ਹ ਹੋਇਆ\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/pl.po b/po/pl.po
index 6c188a31..6c244e65 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-09-24 21:57+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Polish (http://www.transifex.net/projects/p/meego/team/pl/)\n"
@@ -176,7 +176,7 @@ msgstr "Zapytano o hasło, ale ustawiono „--no-passwd”\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Profil XML nie zostanie pobrany, ponieważ suma SHA1 już pasuje\n"
 
-#: auth.c:921 cstp.c:317 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Otwarcie połączenia HTTPS z %s się nie powiodło\n"
@@ -316,466 +316,466 @@ msgstr "(Błąd podczas opisywania błędu)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "BŁĄD: nie można zainicjować gniazd\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:276
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "BŁĄD KRYTYCZNY: główne hasło DTLS jest niezainicjowane. Prosimy to zgłosić.\n"
 
-#: cstp.c:294
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Błąd podczas tworzenia żądania „CONNECT” HTTPS\n"
 
-#: cstp.c:310 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Błąd podczas pobierania odpowiedzi HTTPS\n"
 
-#: cstp.c:337
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Usługa VPN jest niedostępna. Przyczyna: %s\n"
 
-#: cstp.c:342
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Otrzymano nieodpowiednią odpowiedź „CONNECT” HTTPS: %s\n"
 
-#: cstp.c:349
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Otrzymano odpowiedź „CONNECT”: %s\n"
 
-#: cstp.c:377 cstp.c:385
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Brak pamięci dla opcji\n"
 
-#: cstp.c:394 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<opuszczono>"
 
-#: cstp.c:413
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID nie wynosi 64 znaków. Wynosi: „%s”\n"
 
-#: cstp.c:430
+#: cstp.c:433
 #, c-format
 msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID jest nieprawidłowe. Wynosi: „%s”\n"
 
-#: cstp.c:448
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Nieznane DTLS-Content-Encoding %s\n"
 
-#: cstp.c:484
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Nieznane CSTP-Content-Encoding %s\n"
 
-#: cstp.c:559
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Nie otrzymano MTU. Przerywanie\n"
 
-#: cstp.c:567
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Nie otrzymano adresu IP. Przerywanie\n"
 
-#: cstp.c:573
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Otrzymano konfigurację IPv6, ale MTU %d jest za małe.\n"
 
-#: cstp.c:579
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Ponowne połączenie przekazało inny adres IP „Legacy” (%s != %s)\n"
 
-#: cstp.c:587
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "Ponowne połączenie przekazało inną maskę sieci IP „Legacy” (%s != %s)\n"
 
-#: cstp.c:595
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Ponowne połączenie przekazało inny adres IPv6 (%s != %s)\n"
 
-#: cstp.c:603
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Ponowne połączenie przekazało inną maskę sieci IPv6 (%s != %s)\n"
 
-#: cstp.c:623
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "Połączono CSTP. DPD %d, Keepalive %d\n"
 
-#: cstp.c:625
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "Zestaw szyfrów CSTP: %s\n"
 
-#: cstp.c:687
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Ustawienie kompresji się nie powiodło\n"
 
-#: cstp.c:704
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Przydzielenie bufora „deflate” się nie powiodło\n"
 
-#: cstp.c:762
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "„inflate” się nie powiodło\n"
 
-#: cstp.c:785
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Dekompresja LZS się nie powiodła: %s\n"
 
-#: cstp.c:798
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Dekompresja LZ4 się nie powiodła\n"
 
-#: cstp.c:805
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Nieznany typ kompresji %d\n"
 
-#: cstp.c:810
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 "Otrzymano skompresowany pakiet danych %s o rozmiarze %d bajtów (wynosił %d)\n"
 
-#: cstp.c:830
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "%d „deflate” się nie powiodło\n"
 
-#: cstp.c:900 dtls.c:239 dtls.c:698 esp.c:171 mainloop.c:67 oncp.c:933
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Przydzielenie się nie powiodło\n"
 
-#: cstp.c:911
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Otrzymano krótki pakiet (%d bajtów)\n"
 
-#: cstp.c:924
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 "Nieoczekiwana długość pakietu. „SSL_read” zwróciło %d, ale pakiet wynosi\n"
 
-#: cstp.c:938
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Otrzymano żądanie „DPD” CSTP\n"
 
-#: cstp.c:944
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Otrzymano odpowiedź „DPD” CSTP\n"
 
-#: cstp.c:949
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Otrzymano „Keepalive” CSTP\n"
 
-#: cstp.c:954 oncp.c:1022
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Otrzymano nieskompresowany pakiet danych o rozmiarze %d bajtów\n"
 
-#: cstp.c:971
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Otrzymano rozłączenie z serwera: %02x „%s”\n"
 
-#: cstp.c:974
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Otrzymano rozłączenie z serwera\n"
 
-#: cstp.c:982
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Otrzymano nieskompresowany pakiet w trybie „!deflate”\n"
 
-#: cstp.c:991
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "otrzymano pakiet wymuszenia zakończenia serwera\n"
 
-#: cstp.c:998
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Nieznany pakiet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1041 oncp.c:1139
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL zapisało za mało bajtów. Poproszono o %d, wysłano %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1069 oncp.c:1177
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "„rekey” CSTP do\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1076 oncp.c:1184
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Ponowne powitanie się nie powiodło. Próbowanie „new-tunnel”\n"
 
-#: cstp.c:1087 oncp.c:1195
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "Wykrywanie martwych partnerów CSTP wykryło martwego partnera.\n"
 
-#: cstp.c:1091 oncp.c:1109 oncp.c:1199
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Ponowne połączenie się nie powiodło\n"
 
-#: cstp.c:1107 oncp.c:1215
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Wysłanie „DPD” CSTP\n"
 
-#: cstp.c:1119 oncp.c:1226
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Wysłanie „Keepalive” CSTP\n"
 
-#: cstp.c:1144
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 "Wysyłanie nieskompresowanego pakietu danych o rozmiarze %d bajtów (wynosił "
 "%d)\n"
 
-#: cstp.c:1155 oncp.c:1251
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Wysyłanie nieskompresowanego pakietu danych o rozmiarze %d bajtów\n"
 
-#: cstp.c:1194
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Wysłanie pakietu „BYE”: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Próbowanie uwierzytelnienia „Digest” do pośrednika\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Próbowanie uwierzytelnienia „Digest” do serwera „%s”\n"
 
-#: dtls.c:75
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "Próbowano połączenia DTLS za pomocą istniejącego deskryptora pliku\n"
 
-#: dtls.c:81
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Brak adresu DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:88
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Serwer nie zaproponował żadnej opcji szyfrowania DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:95
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Brak DTLS podczas łączenia przez pośrednika\n"
 
-#: dtls.c:157
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Opcja DTLS %s: %s\n"
 
-#: dtls.c:198
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "Zainicjowano DTLS. DPD %d, Keepalive %d\n"
 
-#: dtls.c:224
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Próba nowego połączenia DTLS\n"
 
-#: dtls.c:250
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Otrzymano pakiet DTLS 0x%02x z %d bajtów\n"
 
-#: dtls.c:264
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Otrzymano żądanie „DPD” DTLS\n"
 
-#: dtls.c:270
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 "Wysłanie odpowiedzi DPD się nie powiodło. Należy oczekiwać rozłączenia\n"
 
-#: dtls.c:274
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Otrzymano odpowiedź „DPD” DTLS\n"
 
-#: dtls.c:278
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Otrzymano „Keepalive” DTLS\n"
 
-#: dtls.c:284
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Otrzymano skompresowany pakiet DTLS, kiedy kompresja jest wyłączona\n"
 
-#: dtls.c:292
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Nieznany typ pakietu DTLS %02x, len %d\n"
 
-#: dtls.c:314
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "„rekey” DTLS do\n"
 
-#: dtls.c:321
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Ponowne powitanie DTLS się nie powiodło. Łączenie ponownie.\n"
 
-#: dtls.c:330
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "Wykrywanie martwych partnerów DTLS wykryło martwego partnera.\n"
 
-#: dtls.c:336
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Wysłanie „DPD” DTLS\n"
 
-#: dtls.c:341
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Wysłanie żądania DPD się nie powiodło. Należy oczekiwać rozłączenia\n"
 
-#: dtls.c:354
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Wysłanie „Keepalive” DTLS\n"
 
-#: dtls.c:359
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 "Wysłanie żądania Keepalive się nie powiodło. Należy oczekiwać rozłączenia\n"
 
-#: dtls.c:390 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Otrzymano nieznany pakiet (len %d): %02x %02x %02x %02x...\n"
 
-#: dtls.c:397
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr "Ten TOS: %d, ostatni TOS: %d\n"
 
-#: dtls.c:401
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr "setsockopt UDP"
 
-#: dtls.c:432
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS otrzymało błąd zapisu %d. Używanie SSL\n"
 
-#: dtls.c:446
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS otrzymało błąd zapisu: %s. Używanie SSL\n"
 
-#: dtls.c:461
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Wysłano pakiet DTLS o rozmiarze %d bajtów. Wysłanie DTLS zwróciło %d\n"
 
-#: dtls.c:489
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Inicjowanie wykrywania MTU IPv4 (min=%d, max=%d)\n"
 
-#: dtls.c:509
+#: dtls.c:527
 msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 "Za dużo czasu w pętli wykrywania MTU. Przyjmowanie wynegocjowanego MTU.\n"
 
-#: dtls.c:513
+#: dtls.c:531
 #, c-format
 msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr "Za dużo czasu w pętli wykrywania MTU. Ustawiono MTU na %d.\n"
 
-#: dtls.c:522
+#: dtls.c:540
 #, c-format
 msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr "Wysyłanie sondy „DPD” MTU (%u bajtów, min=%u, max=%u)\n"
 
-#: dtls.c:526
+#: dtls.c:544
 #, c-format
 msgid "Failed to send DPD request (%d %d)\n"
 msgstr "Wysłanie żądania DPD się nie powiodło (%d %d)\n"
 
-#: dtls.c:540 dtls.c:648
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 "Odebrano nieoczekiwany pakiet (%.2x) podczas wykrywania MTU. Pomijanie.\n"
 
-#: dtls.c:552
+#: dtls.c:570
 #, c-format
 msgid "Timeout while waiting for DPD response; trying %d\n"
 msgstr ""
 "Przekroczono czas oczekiwania podczas oczekiwania na odpowiedź DPD. "
 "Próbowanie %d\n"
 
-#: dtls.c:559 dtls.c:640
+#: dtls.c:577 dtls.c:658
 msgid "Timeout while waiting for DPD response; resending probe.\n"
 msgstr ""
 "Przekroczono czas oczekiwania podczas czekania na odpowiedź DPD. Ponowne "
 "wysyłanie sondy.\n"
 
-#: dtls.c:566 dtls.c:667
+#: dtls.c:584 dtls.c:685
 #, c-format
 msgid "Failed to recv DPD request (%d)\n"
 msgstr "Odebranie żądania DPD się nie powiodło (%d)\n"
 
-#: dtls.c:571
+#: dtls.c:589
 #, c-format
 msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr "Otrzymano sondę „DPD” MTU (%u bajtów z %u)\n"
 
-#: dtls.c:609
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Inicjowanie wykrywania MTU IPv6\n"
 
-#: dtls.c:624
+#: dtls.c:642
 #, c-format
 msgid "Sending MTU DPD probe (%u bytes)\n"
 msgstr "Wysyłanie sondy „DPD” MTU (%u bajtów)\n"
 
-#: dtls.c:628
+#: dtls.c:646
 #, c-format
 msgid "Failed to send DPD request (%d)\n"
 msgstr "Wysłanie żądania DPD się nie powiodło (%d)\n"
 
-#: dtls.c:653
+#: dtls.c:671
 #, c-format
 msgid "Received MTU DPD probe (%u bytes)\n"
 msgstr "Otrzymano sondę „DPD” MTU (%u bajtów)\n"
 
-#: dtls.c:717
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "Wykryto MTU o rozmiarze %d bajtów (wynosił %d)\n"
 
-#: dtls.c:720
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Brak zmian w MTU po wykrywaniu (wynosił %d)\n"
@@ -909,88 +909,98 @@ msgstr "Wysłanie pakietu ESP się nie powiodło: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Wysłano pakiet ESP o rozmiarze %d bajtów\n"
 
-#: gnutls-dtls.c:164
+#: gnutls-dtls.c:168
 msgid "Failed to generate DTLS priority string\n"
 msgstr "Utworzenie ciągu priorytetu DTLS się nie powiodło\n"
 
-#: gnutls-dtls.c:173
+#: gnutls-dtls.c:177
 #, c-format
 msgid "Failed to initialize DTLS: %s\n"
 msgstr "Zainicjowanie DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:182
+#: gnutls-dtls.c:186
 #, c-format
 msgid "Failed to set DTLS priority: '%s': %s\n"
 msgstr "Ustawienie priorytetu DTLS się nie powiodło: „%s”: %s\n"
 
-#: gnutls-dtls.c:194
+#: gnutls-dtls.c:198
 #, c-format
 msgid "Failed to allocate credentials: %s\n"
 msgstr "Przydzielenie danych uwierzytelniających się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:207
+#: gnutls-dtls.c:211
 #, c-format
 msgid "Failed to generate DTLS key: %s\n"
 msgstr "Utworzenie klucza DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:221
+#: gnutls-dtls.c:225
 #, c-format
 msgid "Failed to set DTLS key: %s\n"
 msgstr "Ustawienie klucza DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:229
+#: gnutls-dtls.c:233
 #, c-format
 msgid "Failed to set DTLS PSK credentials: %s\n"
 msgstr ""
 "Ustawienie danych uwierzytelniających „PSK” DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:262
+#: gnutls-dtls.c:266
 #, c-format
 msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
 msgstr "Nieznane parametry DTLS dla żądanego zestawu szyfrów „%s”\n"
 
-#: gnutls-dtls.c:277
+#: gnutls-dtls.c:281
 #, c-format
 msgid "Failed to set DTLS priority: %s\n"
 msgstr "Ustawienie priorytetu DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:298
+#: gnutls-dtls.c:302
 #, c-format
 msgid "Failed to set DTLS session parameters: %s\n"
 msgstr "Ustawienie parametrów sesji DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:321 openssl-dtls.c:404
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
 msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
 msgstr ""
 "Wznowienie sesji DTLS się nie powiodło. Możliwe, że to atak typu „MITM”. "
 "Wyłączanie DTLS.\n"
 
-#: gnutls-dtls.c:334
+#: gnutls-dtls.c:363
 #, c-format
 msgid "Failed to set DTLS MTU: %s\n"
 msgstr "Ustawienie „MTU” DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:352
+#: gnutls-dtls.c:382
 #, c-format
 msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
 msgstr ""
 "Nawiązano połączenie DTLS (używając biblioteki GnuTLS). Zestaw szyfrów %s.\n"
 
-#: gnutls-dtls.c:358 openssl-dtls.c:421
+#: gnutls-dtls.c:388 openssl-dtls.c:522
 #, c-format
 msgid "DTLS connection compression using %s.\n"
 msgstr "Kompresja połączenia DTLS używając %s.\n"
 
-#: gnutls-dtls.c:373 openssl-dtls.c:502 openssl-dtls.c:506
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
 msgid "DTLS handshake timed out\n"
 msgstr "Powitanie DTLS przekroczyło czas oczekiwania\n"
 
-#: gnutls-dtls.c:376
+#: gnutls-dtls.c:406
 #, c-format
 msgid "DTLS handshake failed: %s\n"
 msgstr "Powitanie DTLS się nie powiodło: %s\n"
 
-#: gnutls-dtls.c:380
+#: gnutls-dtls.c:410
 msgid "(Is a firewall preventing you from sending UDP packets?)\n"
 msgstr "(Czy zapora sieciowa uniemożliwia wysyłanie pakietów UDP?)\n"
 
@@ -1033,7 +1043,7 @@ msgstr "Utworzenie pakietu „IV” ESP się nie powiodło: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Zaszyfrowanie pakietu ESP się nie powiodło: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Anulowano zapis SSL\n"
 
@@ -1042,7 +1052,7 @@ msgstr "Anulowano zapis SSL\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Zapisanie do gniazda SSL się nie powiodło: %s\n"
 
-#: gnutls.c:176 gnutls.c:268 openssl.c:191 openssl.c:258
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Anulowano odczyt SSL\n"
 
@@ -1072,15 +1082,15 @@ msgstr "Wysłanie SSL się nie powiodło: %s\n"
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Nie można wydobyć czasu wygaśnięcia certyfikatu\n"
 
-#: gnutls.c:351 openssl.c:1611
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Certyfikat klienta wygasł w"
 
-#: gnutls.c:353 openssl.c:1616
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Certyfikat klienta niedługo wygaśnie w"
 
-#: gnutls.c:402 openssl.c:786
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Wczytanie elementu „%s” z bazy kluczy się nie powiodło: %s\n"
@@ -1109,11 +1119,11 @@ msgstr "Odczytanie certyfikatu do pamięci się nie powiodło: %s\n"
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Ustawienie struktury danych PKCS#12 się nie powiodło: %s\n"
 
-#: gnutls.c:493 openssl.c:555
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Odszyfrowanie pliku certyfikatu PKCS#12 się nie powiodło\n"
 
-#: gnutls.c:497 openssl.c:558
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Hasło PKCS#12:"
 
@@ -1188,7 +1198,7 @@ msgstr "Odszyfrowanie klucza PEM się nie powiodło: %s\n"
 msgid "Decrypting PEM key failed\n"
 msgstr "Odszyfrowanie klucza PEM się nie powiodło\n"
 
-#: gnutls.c:996 gnutls.c:1530 openssl.c:479
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Hasło PEM:"
 
@@ -1220,7 +1230,7 @@ msgstr "Błąd podczas wczytywania certyfikatu z PKCS#11: %s\n"
 msgid "Error loading system certificate: %s\n"
 msgstr "Błąd podczas wczytywania systemowego certyfikatu: %s\n"
 
-#: gnutls.c:1159 openssl.c:842
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Używanie pliku certyfikatu %s\n"
@@ -1284,7 +1294,7 @@ msgstr ""
 msgid "Using private key file %s\n"
 msgstr "Używanie pliku klucza prywatnego %s\n"
 
-#: gnutls.c:1451 openssl.c:666
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Ta wersja OpenConnect została zbudowana bez obsługi TPM\n"
 
@@ -1302,7 +1312,7 @@ msgstr "Wczytanie klucza prywatnego PKCS#1 się nie powiodło: %s\n"
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Wczytanie klucza prywatnego jako PKCS#8 się nie powiodło: %s\n"
 
-#: gnutls.c:1526 gnutls.c:1559 openssl.c:1013 openssl.c:1023
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Odszyfrowanie pliku certyfikatu PKCS#8 się nie powiodło\n"
 
@@ -1311,7 +1321,7 @@ msgstr "Odszyfrowanie pliku certyfikatu PKCS#8 się nie powiodło\n"
 msgid "Failed to determine type of private key %s\n"
 msgstr "Ustalenie typu klucza prywatnego %s się nie powiodło\n"
 
-#: gnutls.c:1563 openssl.c:1019
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Hasło PKCS#8:"
 
@@ -1335,7 +1345,7 @@ msgstr "Błąd podczas sprawdzania poprawności podpisu z certyfikatem: %s\n"
 msgid "No SSL certificate found to match private key\n"
 msgstr "Nie odnaleziono certyfikatu SSL pasującego do klucza prywatnego\n"
 
-#: gnutls.c:1675 openssl.c:581 openssl.c:724
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Używanie certyfikatu klienta „%s”\n"
@@ -1380,158 +1390,158 @@ msgstr "Dodawanie wspierającego CA „%s”\n"
 msgid "Setting certificate failed: %s\n"
 msgstr "Ustawienie certyfikatu się nie powiodło: %s\n"
 
-#: gnutls.c:2074
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Serwer nie przedstawił żadnego certyfikatu\n"
 
-#: gnutls.c:2082
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 "Błąd podczas porównywania certyfikatu serwera przy ponownym powitaniu: %s\n"
 
-#: gnutls.c:2087 openssl.c:1534
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "Serwer przedstawił inny certyfikat podczas ponownego powitania\n"
 
-#: gnutls.c:2092 openssl.c:1537
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "Serwer przedstawił identyczny certyfikat podczas ponownego powitania\n"
 
-#: gnutls.c:2098
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Błąd podczas inicjowania struktury certyfikatów X.509\n"
 
-#: gnutls.c:2104
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Błąd podczas importowania certyfikatu serwera\n"
 
-#: gnutls.c:2113 main.c:1705
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Nie można obliczyć sumy kontrolnej certyfikatu serwera\n"
 
-#: gnutls.c:2118
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Błąd podczas sprawdzania stanu certyfikatu serwera\n"
 
-#: gnutls.c:2123
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "unieważniony certyfikat"
 
-#: gnutls.c:2125
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "nie odnaleziono podpisującego"
 
-#: gnutls.c:2127
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "podpisujący nie jest certyfikatem CA"
 
-#: gnutls.c:2129
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "niebezpieczny algorytm"
 
-#: gnutls.c:2131
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certyfikat nie został jeszcze aktywowany"
 
-#: gnutls.c:2133
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certyfikat wygasł"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2138
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "sprawdzenie poprawności podpisu się nie powiodło"
 
-#: gnutls.c:2187 openssl.c:1418 openssl.c:1570
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certyfikat nie pasuje do nazwy komputera"
 
-#: gnutls.c:2192 openssl.c:1417 openssl.c:1576
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Sprawdzenie poprawności certyfikatu klienta się nie powiodło: %s\n"
 
-#: gnutls.c:2264
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Przydzielenie pamięci dla certyfikatów pliku CA się nie powiodło\n"
 
-#: gnutls.c:2285
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Odczytanie certyfikatów z pliku CA się nie powiodło: %s\n"
 
-#: gnutls.c:2301
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Otwarcie pliku CA „%s” się nie powiodło: %s\n"
 
-#: gnutls.c:2314 openssl.c:1698
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Wczytanie certyfikatu się nie powiodło. Przerywanie.\n"
 
-#: gnutls.c:2385
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Ustawienie ciągu priorytetu TLS się nie powiodło („%s”): %s\n"
 
-#: gnutls.c:2397 openssl.c:1815
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Negocjacja SSL z %s\n"
 
-#: gnutls.c:2444 openssl.c:1841
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Anulowano połączenie SSL\n"
 
-#: gnutls.c:2451
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Niepowodzenie połączenia SSL: %s\n"
 
-#: gnutls.c:2460
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Niekrytyczny zwrot biblioteki GnuTLS podczas powitania: %s\n"
 
-#: gnutls.c:2466 openssl.c:1858
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Połączono z HTTPS na %s\n"
 
-#: gnutls.c:2469
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Ponownie negocjowano SSL na %s\n"
 
-#: gnutls.c:2776 openssl-pkcs11.c:199
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "Wymagany jest kod PIN dla %s"
 
-#: gnutls.c:2780 openssl-pkcs11.c:202
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Błędny kod PIN"
 
-#: gnutls.c:2783
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "To ostatnia próba przed zablokowaniem."
 
-#: gnutls.c:2785
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Pozostało tylko kilka prób przed zablokowaniem."
 
-#: gnutls.c:2790 openssl-pkcs11.c:206
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Proszę wprowadzić kod PIN:"
 
-#: gnutls.c:2921 openssl.c:1986
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Nieobsługiwany algorytm HMAC „OATH”\n"
 
-#: gnutls.c:2930
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Obliczenie HMAC „OATH” się nie powiodło: %s\n"
@@ -1733,7 +1743,7 @@ msgstr "Próbowanie podstawowego uwierzytelnienia HTTP do pośrednika\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Próbowanie podstawowego uwierzytelnienia HTTP z serwerem „%s”\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Ta wersja OpenConnect została zbudowana bez obsługi GSSAPI\n"
 
@@ -1755,243 +1765,243 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Nie ma więcej metod uwierzytelnienia do wypróbowania\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Brak pamięci do przydzielenia ciasteczek\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Przetworzenie odpowiedzi HTTP „%s” się nie powiodło\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Otrzymano odpowiedź HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Błąd podczas przetwarzania odpowiedzi HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ignorowanie nieznanego wiersza odpowiedzi HTTP „%s”\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Zaproponowano nieprawidłowe ciasteczko: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Uwierzytelnienie certyfikatu SSL się nie powiodło\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Treść odpowiedzi ma ujemny rozmiar (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Nieznane Transfer-Encoding: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "Treść HTTP %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Błąd podczas odczytywania treści odpowiedzi HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Błąd podczas pobierania nagłówka fragmentu\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Błąd podczas pobierania treści odpowiedzi HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 "Błąd podczas fragmentarycznego dekodowania. Oczekiwano „”, otrzymano: „%s”"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Nie można pobrać treści HTTP 1.0 bez zamknięcia połączenia\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Przetworzenie przekierowanego adresu URL „%s” się nie powiodło: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 "Nie można podążyć za przekierowaniem do adresu URL „%s” niebędącego HTTPS\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 "Przydzielenie nowej ścieżki dla względnego przekierowania się nie powiodło: "
 "%s\n"
 
-#: http.c:929 oncp.c:592 oncp.c:629
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Oczekiwano %d wyników z serwera\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "udzielono żądanie"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "ogólne niepowodzenie"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "połączenie niedozwolone przez zestaw reguł"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "sieć jest nieosiągalna"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "komputer jest nieosiągalny"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "połączenie odrzucone przez komputer docelowy"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL wygasło"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "nieobsługiwane polecenie/błąd protokołu"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "nieobsługiwany typ adresu"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr "Serwer SOCKS zażądał nazwy użytkownika/hasło, ale nie ma żadnego\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "Nazwa użytkownika i hasło do uwierzytelnienia SOCKS musi być < 255 bajtów\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 "Błąd podczas zapisywania żądania uwierzytelnienia do pośrednika SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 "Błąd podczas odczytywania żądania uwierzytelnienia z pośrednika SOCKS: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 "Nieoczekiwana odpowiedź uwierzytelnienia z pośrednika SOCKS: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Uwierzytelniono z serwerem SOCKS używając hasła\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Uwierzytelnienie hasłem z serwerem SOCKS się nie powiodło\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "Serwer SOCKS zażądał uwierzytelnienia GSSAPI\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "Serwer SOCKS zażądał uwierzytelnienia hasłem\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "Serwer SOCKS wymaga uwierzytelnienia\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "Serwer SOCKS zażądał nieznanego typu uwierzytelnienia %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Żądanie połączenia pośrednika SOCKS do %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Błąd podczas zapisywania żądania połączenia do pośrednika SOCKS: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Błąd podczas odczytywania żądania połączenia z pośrednika SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Nieoczekiwana odpowiedź połączenia z pośrednika SOCKS: %02x %02x…\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Błąd pośrednika SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Błąd pośrednika SOCKS %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Nieoczekiwany typ adresu %02x w odpowiedzi połączenia SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Żądanie połączenia pośrednika HTTP do %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Wysłanie żądania pośrednika się nie powiodło: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Żądanie „CONNECT” pośrednika się nie powiodło: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Nieznany typ pośrednika „%s”\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Obsługiwane są tylko pośredniki HTTP i SOCKS(5)\n"
 
@@ -2004,16 +2014,28 @@ msgstr "Nieznany protokół VPN „%s”\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Zbudowano z biblioteką SSL bez obsługi DTLS firmy Cisco\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Przetworzenie adresu URL serwera „%s” się nie powiodło\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "W adresach URL serwera dozwolone jest tylko „https://”\n"
 
-#: library.c:1019
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Brak programu obsługującego formularze. Nie można uwierzytelnić.\n"
 
@@ -2737,16 +2759,16 @@ msgstr "Ustawienie skryptu tun się nie powiodło\n"
 msgid "Set up tun device failed\n"
 msgstr "Ustawienie urządzenia tun się nie powiodło\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Wywołujący wstrzymał połączenie\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Nie ma nic do zrobienia. Usypianie na %d ms…\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "WaitForMultipleObjects się nie powiodło: %s\n"
@@ -2814,7 +2836,7 @@ msgstr "Serwer odrzuca token programowy. Przełączanie na wprowadzanie ręczne\
 msgid "Generating OATH TOTP token code\n"
 msgstr "Tworzenie kodu tokena „TOTP” OATH\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Tworzenie kodu tokena „HOTP” OATH\n"
 
@@ -3074,59 +3096,64 @@ msgstr "Wychodzący pakiet:\n"
 msgid "Sent ESP enable control packet\n"
 msgstr "Wysłano pakiet kontroli włączenia ESP\n"
 
-#: openconnect-internal.h:1065 openconnect-internal.h:1073
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 "BŁĄD: %s() zostało wywołane za pomocą nieprawidłowego UTF-8 dla parametru "
 "„%s”\n"
 
-#: openssl-dtls.c:134
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
 #, c-format
 msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
 msgstr ""
 "Utworzenie „SSL_SESSION ASN.1” dla biblioteki OpenSSL się nie powiodło: %s\n"
 
-#: openssl-dtls.c:145
+#: openssl-dtls.c:227
 msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
 msgstr ""
 "Przetworzenie „SSL_SESSION ASN.1” przez bibliotekę OpenSSL się nie powiodło\n"
 
-#: openssl-dtls.c:159
+#: openssl-dtls.c:241
 msgid "Initialise DTLSv1 session failed\n"
 msgstr "Zainicjowanie sesji DTLSv1 się nie powiodło\n"
 
-#: openssl-dtls.c:188
+#: openssl-dtls.c:270
 msgid "PSK callback\n"
 msgstr "Wywołanie zwrotne PSK\n"
 
-#: openssl-dtls.c:205
+#: openssl-dtls.c:287
 msgid "Failed to create app-identity extension for OpenSSL\n"
 msgstr ""
 "Utworzenie rozszerzenia „app-identity” dla biblioteki OpenSSL się nie "
 "powiodło\n"
 
-#: openssl-dtls.c:269
+#: openssl-dtls.c:352
 msgid "Initialise DTLSv1 CTX failed\n"
 msgstr "Zainicjowanie sesji „CTX” DTLSv1 się nie powiodło\n"
 
-#: openssl-dtls.c:282
+#: openssl-dtls.c:365
 msgid "Set DTLS CTX version failed\n"
 msgstr "Ustawienie wersji „CTX” DTLS się nie powiodło\n"
 
-#: openssl-dtls.c:299
+#: openssl-dtls.c:382
 msgid "Failed to generate DTLS key\n"
 msgstr "Utworzenie klucza DTLS się nie powiodło\n"
 
-#: openssl-dtls.c:319
+#: openssl-dtls.c:402
 msgid "Set DTLS cipher list failed\n"
 msgstr "Ustawienie listy szyfrów DTLS się nie powiodło\n"
 
-#: openssl-dtls.c:333
+#: openssl-dtls.c:417
 msgid "Not precisely one DTLS cipher\n"
 msgstr "Nie wynosi dokładnie jednego szyfru DTLS\n"
 
-#: openssl-dtls.c:366
+#: openssl-dtls.c:439
 #, c-format
 msgid ""
 "SSL_set_session() failed with old protocol version 0x%x\n"
@@ -3139,19 +3166,19 @@ msgstr ""
 "Więcej informacji na http://rt.openssl.org/Ticket/Display.html?id=1751\n"
 "Należy użyć opcji wiersza poleceń „--no-dtls”, aby uniknąć tego komunikatu\n"
 
-#: openssl-dtls.c:415
+#: openssl-dtls.c:516
 #, c-format
 msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
 msgstr ""
 "Nawiązano połączenie DTLS (używając biblioteki OpenSSL). Zestaw szyfrów %s.\n"
 
-#: openssl-dtls.c:452
+#: openssl-dtls.c:553
 msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
 msgstr ""
 "Biblioteka OpenSSL jest starsza niż ta, z którą zbudowano, więc DTLS może "
 "się nie powieść."
 
-#: openssl-dtls.c:503
+#: openssl-dtls.c:604
 msgid ""
 "This is probably because your OpenSSL is broken\n"
 "See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
@@ -3159,7 +3186,7 @@ msgstr ""
 "Prawdopodobnie biblioteka OpenSSL jest uszkodzona\n"
 "Więcej informacji na http://rt.openssl.org/Ticket/Display.html?id=2984\n"
 
-#: openssl-dtls.c:510
+#: openssl-dtls.c:611
 #, c-format
 msgid "DTLS handshake failed: %d\n"
 msgstr "Powitanie DTLS się nie powiodło: %d\n"
@@ -3260,7 +3287,7 @@ msgstr "Odnalezienie certyfikatu PKCS#11 „%s” się nie powiodło\n"
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "Biblioteka libp11 nie pobrała treści certyfikatu X.509\n"
 
-#: openssl-pkcs11.c:412 openssl.c:728
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 "Zainstalowanie certyfikatu w kontekście biblioteki OpenSSL się nie powiodło\n"
@@ -3314,262 +3341,262 @@ msgstr "Dodanie klucza z PKCS#11 się nie powiodło\n"
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Ta wersja OpenConnect została zbudowana bez obsługi PKCS#11\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Zapisanie do gniazda SSL się nie powiodło\n"
 
-#: openssl.c:184 openssl.c:250
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Odczytanie z gniazda SSL się nie powiodło\n"
 
-#: openssl.c:279
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Błąd odczytu SSL %d (serwer prawdopodobnie zamknął połączenie). Łączenie "
 "ponownie.\n"
 
-#: openssl.c:304
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write się nie powiodło: %d\n"
 
-#: openssl.c:378
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Nieobsłużony typ żądania interfejsu użytkownika SSL %d\n"
 
-#: openssl.c:486
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Hasło PEM jest za długie (%d >= %d)\n"
 
-#: openssl.c:519
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Dodatkowy certyfikat z %s: „%s”\n"
 
-#: openssl.c:569
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Przetworzenie PKCS#12 się nie powiodło (błędy powyżej)\n"
 
-#: openssl.c:584
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 nie zawiera żadnego certyfikatu\n"
 
-#: openssl.c:593
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 nie zawiera żadnego klucza prywatnego\n"
 
-#: openssl.c:598
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:616
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Nie można wczytać mechanizmu TPM.\n"
 
-#: openssl.c:622
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Zainicjowanie mechanizmu TPM się nie powiodło\n"
 
-#: openssl.c:632
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Ustawienie hasła „SRK” TPM się nie powiodło\n"
 
-#: openssl.c:646
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Wczytanie klucza prywatnego TPM się nie powiodło\n"
 
-#: openssl.c:652
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Dodanie klucza z TPM się nie powiodło\n"
 
-#: openssl.c:702 openssl.c:850
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Otwarcie pliku certyfikatu %s się nie powiodło: %s\n"
 
-#: openssl.c:712
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Wczytanie certyfikatu się nie powiodło\n"
 
-#: openssl.c:750
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Przetworzenie wszystkich obsługiwanych certyfikatów się nie powiodło. "
 "Próbowanie mimo to…\n"
 
-#: openssl.c:763
+#: openssl.c:776
 msgid "PEM file"
 msgstr "Plik PEM"
 
-#: openssl.c:792
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Utworzenie „BIO” dla elementu bazy kluczy „%s” się nie powiodło\n"
 
-#: openssl.c:817
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Wczytanie klucza prywatnego się nie powiodło (błędne hasło?)\n"
 
-#: openssl.c:823
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Wczytanie klucza prywatnego się nie powiodło (błędy powyżej)\n"
 
-#: openssl.c:873
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Wczytanie certyfikatu X.509 z bazy kluczy się nie powiodło\n"
 
-#: openssl.c:879
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Użycie certyfikatu X.509 z bazy kluczy się nie powiodło\n"
 
-#: openssl.c:911
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Użycie klucza prywatnego z bazy kluczy się nie powiodło\n"
 
-#: openssl.c:927
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Otwarcie pliku klucza prywatnego %s się nie powiodło: %s\n"
 
-#: openssl.c:947 openssl.c:962 openssl.c:983 openssl.c:1049
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Wczytanie klucza prywatnego się nie powiodło\n"
 
-#: openssl.c:1043
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr "Konwertowanie PKCS#8 na EVP_PKEY biblioteki OpenSSL się nie powiodło\n"
 
-#: openssl.c:1060
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Zidentyfikowanie typu klucza prywatnego w „%s” się nie powiodło\n"
 
-#: openssl.c:1222
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Pasujące „altname” DNS „%s”\n"
 
-#: openssl.c:1229
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Nic nie pasuje do „altname” „%s”\n"
 
-#: openssl.c:1243
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Certyfikat posiada „altname” GEN_IPADD z fałszywą długością %d\n"
 
-#: openssl.c:1254 openssl.c:1400
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Pasujący adres %s „%s”\n"
 
-#: openssl.c:1261
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Nic nie pasuje do adresu %s „%s”\n"
 
-#: openssl.c:1303
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "Adres URI „%s” posiada niepustą ścieżkę. Ignorowanie\n"
 
-#: openssl.c:1308
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Pasujący adres URI „%s”\n"
 
-#: openssl.c:1319
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Nic nie pasuje do adresu URI „%s”\n"
 
-#: openssl.c:1334
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Żadne „altname” w certyfikacie partnera nie pasuje do „%s”\n"
 
-#: openssl.c:1342
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Brak nazwy tematu w certyfikacie partnera\n"
 
-#: openssl.c:1362
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Przetworzenie nazwy tematu w certyfikacie partnera się nie powiodło\n"
 
-#: openssl.c:1369
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Niedopasowanie tematu certyfikatu partnera („%s” != „%s”)\n"
 
-#: openssl.c:1374 openssl.c:1408
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Pasująca nazwa tematu certyfikatu partnera „%s”\n"
 
-#: openssl.c:1470
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Dodatkowy certyfikat z pliku CA: „%s”\n"
 
-#: openssl.c:1608
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Błąd w polu „notAfter” certyfikatu klienta\n"
 
-#: openssl.c:1621
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<błąd>"
 
-#: openssl.c:1674
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr "Utworzenie „CTX” TLSv1 się nie powiodło\n"
 
-#: openssl.c:1693
+#: openssl.c:1705
 msgid "SSL certificate and key do not match\n"
 msgstr "Certyfikat SSL i klucz nie pasują\n"
 
-#: openssl.c:1738
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Odczytanie certyfikatów z pliku CA „%s” się nie powiodło\n"
 
-#: openssl.c:1771
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Otwarcie pliku CA „%s” się nie powiodło\n"
 
-#: openssl.c:1831
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Niepowodzenie połączenia SSL\n"
 
-#: openssl.c:1992
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Obliczenie „HMAC” OATH się nie powiodło\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Odrzucanie błędnego dołączania „split”: „%s”\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Odrzucanie błędnego wykluczania „split”: „%s”\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Wywołanie skryptu „%s” dla %s się nie powiodło: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Skrypt „%s” nieoczekiwanie zakończył działanie (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Skrypt „%s” zwrócił błąd %d\n"
@@ -4281,18 +4308,3 @@ msgstr "polecenie obliczania"
 #: yubikey.c:608
 msgid "Unrecognised response from Yubikey when generating tokencode\n"
 msgstr "Nierozpoznana odpowiedź z Yubikey podczas tworzenia kodu tokena\n"
-
-#~ msgid "using OpenSSL"
-#~ msgstr "używanie biblioteki OpenSSL"
-
-#~ msgid "Failed to recv DPD request (%d): %s\n"
-#~ msgstr "Odebranie żądania DPD się nie powiodło (%d): %s\n"
-
-#~ msgid "Failed to send DPD request (%d): %s\n"
-#~ msgstr "Wysłanie żądania DPD się nie powiodło (%d): %s\n"
-
-#~ msgid "Too long time in MTU detect loop; bailing out.\n"
-#~ msgstr "Za dużo czasu w pętli wykrywania MTU. Wychodzenie.\n"
-
-#~ msgid "SSL operation cancelled\n"
-#~ msgstr "Anulowano działanie SSL\n"
diff --git a/po/ps.po b/po/ps.po
index 8c15fb6c..6537b783 100644
--- a/po/ps.po
+++ b/po/ps.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Pushto (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/pt.po b/po/pt.po
index 7ec8fab0..147f2ab7 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Portuguese (http://www.transifex.com/projects/p/meego/"
@@ -180,7 +180,7 @@ msgstr "Perguntou pela senha, mas '--no-passwd' definido\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "O perfil XML não será transferido porque SHA1 já coincide\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Falha ao abrir a ligação HTTPS a %s\n"
@@ -317,203 +317,208 @@ msgstr "(erro ao descrever o erro!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "Erro: impossível inicializar sockets\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcb mss %d, env mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "ERRO CRÍTICO: o segredo mestre DTLS não está inicializado. Por favor, "
 "reporte isto.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Erro ao criar pedido HTTPS CONNECT\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Erro ao obter resposta HTTPS\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Serviço VPN indisponível; razão: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Obteve resposta HTTP CONNECT inapropriada: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Obteve resposta CONNECT: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Não há memória para opções\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID não é de 64 caracteres; é de: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "CSTP-Content-Encoding %s desconhecido\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Codificação de Conteúdo Desconhecido CSTP %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Sem MTU recebido. A abortar\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Sem endereço IP recebido. A abortar\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Recebida configuração IPv6 mas MTU %d é demasiado pequeno.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Reconexão deu endereços IP diferentes antigos (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Reconexão deu máscara de rede IP diferente antiga (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Reconexão deu endereços IPv6 diferentes (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Reconexão deu máscara de rede IPv6 diferente (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP ligado. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP Ciphersuite: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "A configuração de compressão falhou\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Falha na alocação do buffer para esvaziar\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "enchimento falhou\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Falha na descompressão LZS: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Falha na descompressão LZ4\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Tipo de compressão \"%d\" desconhecido\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Recebido pacote %s de dados comprimidos de %d bytes (era %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "deflate falhou %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Falha na alocação\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Recebido pacote curto (%d bytes)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 "Comprimento inesperado do pacote. SSL_read devolveu %d mas o pacote é\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Pedido CSTP DPD obtido\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Resposta CSTP DPD obtida\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Obteve CSTP Keepalive\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Recebido pacote de dados não comprimidos de %d bytes\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Recebido o desligamento do servidor: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Recebido fim de ligação do servidor\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Recebido pacote comprimido em modo !deflate\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "pacote de terminação do servidor recebido\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Pacote desconhecido %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
@@ -522,350 +527,276 @@ msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Reescrita de CSTP devida\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Falha no reaperto de mão, a tentar novo túnel\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTP Dead Peer Detection detetou um par morto!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Religação falhou\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Enviar CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Enviar CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "A enviar pacote de dados comprimidos de %d bytes (era %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "A enviar pacote de dados não comprimidos de %d bytes\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Enviar pacote BYE: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "A tentar autenticação Digest no proxy\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "A tentar autenticação Digest no servidor \"%s\"\n"
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr "Falha ao criar SSL_SESSION ASN.1 para OpenSSL: %s\n"
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr "O OpenSSL falhou o processamento de SSL_SESSION ASN 1\n"
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Falhou ao iniciar a sessão DTLSv1\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Falhou a inicialização de DTLSv1 CTX\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Falhou a definição da lista de cifras DTLS\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Não é precisamente uma cifra DTLS\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() falhou com o antigo protocolo versão 0x%x\n"
-"Você está ausar uma versão do OpenSSL anterior do que a 0.9.8m?\n"
-"Consulte http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Utilize a opção de linha de comando --no-dtls para evitar esta mensagem\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "Estabelecida ligação DTLS (usando OpenSSL). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr "Compressão de ligação DTLS usando %s\n"
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"O seu OpenSSL é anterior ao que acabou de compilar, por isso pode falhar o "
-"DTLS!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "Cumprimento DTLS expirado\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Isto é provavelmente porque o seu OpenSSL está quebrado\n"
-"Veja http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "Cumprimento DTLS falhou:%d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Parâmetros DTLS desconhecidos para o CipherSuite \"%s\" pedido\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Falha ao definir a prioridade DTLS: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Falha ao definir parâmetros de sessão DTLS: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Falha ao definir DTLS MTU: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Estabelecida ligação DTLS (usando GnuTLS). Ciphersuite %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Cumprimento DTLS falhou: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(tem uma firewall a impedi-lo de enviar pacotes UDP?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "Tentada ligação DTLS com um fd existente\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Sem endereço DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "O servidor não ofereceu opção de cifra DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Sem DTLS ao ligar via proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Opção DTLS %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "CSTP ligado. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Tentar nova ligação DTLS\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Recebido pacote DTLS 0x%02x de %d bytes\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Pedido DTLS DPD obtido\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Falha ao enviar resposta DPD. Desligar esperado\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Resposta DTLS DPD obtida\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Obteve DTLS Keepalive\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Recebido pacote DTLS comprimido com compressão não ativada\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Tipo de pacote DTLS desconhecido %02x, len %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Reescrita DTLS devida\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Cumprimento DTLS falhou, a religar.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS Dead Peer Detection detetou um par morto!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Enviar DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Falha ao enviar pedido DPD. Desligar esperado\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Enviar DTLS Keepalive\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Falha ao enviar pedido keepalive. Desligar esperado\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Pacote desconhecido (comp %d) recebido: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS obteve erro de escrita %d. A reverter para SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS obteve erro de escrita %s. A reverter para SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Enviado pacote DTLS de %d bytes; o envio DTLS devolveu %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr "A aceitar pacote ESP esperado com seq %u\n"
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "A descartar pacote ESP antigo com seq %u (esperado %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Aceitar pacote ESP atrasado com seq %u (esperado %<PRIu64>)\n"
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Aceitar pacote ESP avariado com seq %u (esperado %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "A descartar pacote ESP antigo com seq %u (esperado %<PRIu64>)\n"
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr "Descartar pacote ESP reproduzido com seq %u\n"
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Aceitar pacote ESP atrasado com seq %u (esperado %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Aceitar pacote ESP avariado com seq %u (esperado %<PRIu64>)\n"
 
 #: esp.c:68
 #, c-format
@@ -967,6 +898,97 @@ msgstr "Falha ao enviar pacote ESP: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Enviado pacote ESP de %d bytes\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Parâmetros DTLS desconhecidos para o CipherSuite \"%s\" pedido\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Falha ao definir a prioridade DTLS: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Falha ao definir parâmetros de sessão DTLS: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Falha ao definir DTLS MTU: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Estabelecida ligação DTLS (usando GnuTLS). Ciphersuite %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr "Compressão de ligação DTLS usando %s\n"
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "Cumprimento DTLS expirado\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Cumprimento DTLS falhou: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(tem uma firewall a impedi-lo de enviar pacotes UDP?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -987,7 +1009,7 @@ msgstr "Falha ao gerar chaves aleatórias para ESP: %s\n"
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr "Falha ao calcular HMAC para pacote ESP: %s\n"
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr "Recebido pacote ESP com HMAC inválido\n"
 
@@ -1006,7 +1028,7 @@ msgstr "Falha ao gerar pacote ESP IV: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Falha ao encriptar pacote ESP: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Escrita SSL cancelada\n"
 
@@ -1015,489 +1037,493 @@ msgstr "Escrita SSL cancelada\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Falha ao escrever na tomada SSL: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Leitura SSL cancelada\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "Tomada SSL fechou suja\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Falha ao ler da tomada SSL: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Erro de leitura SSL: %s, a religar.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "Envio SSL falhou: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Impossível extrair hora de expiração do certificado\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Certificado do cliente expirou em"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Certificado do cliente expira brevemente em"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Falha ao carregar o item \"%s\" da loja: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Falha ao abrir chave/certificado %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Falha na estatística de chave/certificado %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Falha ao alocar buffer de certificado\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Falha ao ler certificado para a memória: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Falha ao configurar estrutura de dados PKCS#12: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Falha ao desencriptar ficheiro de certificado PKCS#12\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Insira a frase-passe de PKCS#12:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Falha ao processar ficheiro PKCS#12: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Falha ao carregar certificado PKCS#12: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Falha ao importar certificado PKCS#12:%s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Falha ao definir certificado PKCS#12: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Impossível inicializar hash MD5: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "Erro de hash MD5: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "DEK-Info em falta: cabeçalho de chave encriptada OpenSSL\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Impossível determinar tipo de encriptação PEM\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Tipo de encriptação PEM não suportado: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Sal inválido no ficheiro PEM encriptado\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Erro de descodificação base 64 no ficheiro PEM encriptado: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Ficheiro PEM encriptado demasiado curto\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Falha ao inicializar cifra para desencriptar ficheiro PEM: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Falha ao desencriptar chave PEM: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Falha ao desencriptar chave PEM\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Introduza a palavra-passe PEM:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Este binário foi compilado sem suporte de chave de sistema\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Este binário foi compilado sem suporte PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "A usar certificado PKCS#11 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "A usar o ficheiro de certificado %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Erro ao carregar o certificado de PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Erro ao carregar o certificado de sistema: %s\n"
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "A usar o ficheiro de certificado %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "O ficheiro PKCS#11 não contém certificados\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Não se encontrou um certificado no ficheiro"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Falha ao carregar o certificado: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "A usar chave de sistema %s\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Erro ao inicializar estrutura da chave privada: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Erro ao importar chave de sistema %s: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "A tentar URL de chave PKCS#11 %s\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Erro ao inicializar estrutura de chave PKCS#11: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Erro ao importar URL PKCS#11 %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "A usar chave PKCS#11 %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Erro ao importar chave PKCS#11 para a estrutura da chave privada: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "A usar ficheiro de chave privada %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Esta versão de OpenConnect foi compilada sem suporte de TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Falha ao interpretar ficheiro PEM\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Falha ao carregar chave privada PKCS#11: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Falha ao carregar chave privada como PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Falha ao desencriptar ficheiro de certificado PKCS#8\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Falha ao determinar tipo de chave privada %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Insira a frase-passe de PKCS#8:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Falha ao obter a ID de chave: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Erro ao assinar dados de teste com a chave privada: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Erro ao validar a assinatura contra o certificado: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Sem certificado SSL para comparar chave privada\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "A usar certificado de cliente \"%s\"\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Falha ao definir lista de revogação de certificado: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Falha ao alocar memória para o certificado\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "AVISO: GnuTLS devolveu emissor incorreto para certificados; a autenticação "
 "pode falhar!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "Obtido CA \"%s\" seguinte de PKCS#11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Falha ao alocar memória para certificados de suporte\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "A adicionar CA \"%s\" de suporte\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Falha ao definir certificado: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "O servidor não apresentou certificado\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Erro ao inicializar estrutura de certificado X509\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Erro ao importar certificado do servidor\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Impossível calcular hash do certificado do servidor\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Erro ao verificar estado do certificado do servidor\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certificado revogado"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "assinante não encontrado"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "assinante não é certificado CA"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "algoritmo inseguro"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certificado ainda não ativado"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certificado expirou"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "falhou a verificação de assinatura"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certificado não corresponde ao nome da máquina"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Falhou a verificação do certificado do servidor: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Falha ao alocar memória para certificados cafile\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Falha ao ler certificados de ficheiro cafile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Falha ao abrir ficheiro CA \"%s\": %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 "Falhou ao carregar o certificado. A abortar.\n"
 "\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Falha ao definir cadeia de prioridade TLS (\"%s\"): %s\n"
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Negociação SSL com %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Ligação SSL cancelada\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Falha na ligação SSL: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Devolução não fatal GnuTLS durante o cumprimento: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Ligado a HTTPS em %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "SSL renegociada em %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN necessário para %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "PIN errado"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Esta é a última tentativa antes de trancar!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Só restam algumas tentativas antes de trancar!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Introduza o PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Algoritmo OATH HMAC não suportado\n"
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Falha ao calcular OATH HMAC: %s\n"
@@ -1691,7 +1717,7 @@ msgstr "A tentar autenticação Basic HTTP no proxy\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "A tentar autenticação Basic HTTP no servidor \"%s\"\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Esta versão do OpenConnect foi compilada sem suporte GSSAPI\n"
 
@@ -1712,237 +1738,237 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Sem mais métodos de autenticação para tentar\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Sem memória para alocar cookies\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Falhou ao processar resposta HTTP '%s'\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Obteve resposta HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Erro ao processar resposta HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "A ignorar linha com resposta HTTP desconhecida '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Cookie inválido oferecido: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Falha na autenticação de certificado SSL\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Corpo de respostas tem tamanho negativo (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Codificação de Conteúdo Desconhecido: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "Corpo HTTP %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Erro ao ler corpo de reposta HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Erro ao obter cabeçalho do pedaço\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Erro ao obter resposta do corpo HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Erro na descodificação do bloco. Esperado '', obtido: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 "Não pode receber corpo em HTTP 1.0 sem ligação de fecho\n"
 "\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Falhou ao processar URL redirecionado '%s': %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Impossível seguir redirecionamento para URL não https \"%s\"\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Falhou a alocação de novo caminho do redirecionamento relativo: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Resultado inesperado %d do servidor\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "pedido concedido"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "falha geral"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "ligação não permitida pelas regras"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "rede inatingível"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "hospedeiro inatingível "
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "ligação recusada pelo hospedeiro no destino"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL expirou"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "comando não suportado / erro de protocolo"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "tipo de endereço não suportado"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr "O servidor SOCKS pediu utilizador/senha mas não há nada\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr "Utilizador e senha para autenticação SOCKS tem de ser < 255 bytes\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Erro ao escrever pedido de autorização ao proxy SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Erro ao ler resposta de autorização do proxy SOCKS: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Resposta de autorização inesperada do proxy SOCKS: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Autenticado no servidor SOCKS usando senha\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Falha na autenticação com senha no servidor SOCKS\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "O servidor SOCKS pediu autenticação GSSAPI\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "O servidor SOCKS pediu autenticação com senha\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "O servidor SOCKS requer autenticação\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "O servidor SOCKS pediu tipo de autenticação %02x desconhecida\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "A pedir ligação SOCKS por proxy a %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Erro ao escrever pedido de ligação ao proxy SOCKS: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Erro ao ler resposta de ligação do proxy SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Resposta de ligação inesperada do proxy SOCKS: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Erro de proxy SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Erro de proxy SOCKS  %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Tipo de endereço inesperado %02x na resposta de ligação SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "A pedir ligação do proxy HTTP a %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Falhou o envio do pedido de proxy: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Falha no pedido CONNECT do proxy: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Tipo de proxy '%s' desconhecido \n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Apenas proxies http ou socks(5) são suportados\n"
 
@@ -1955,45 +1981,62 @@ msgstr "Tipo de protocolo VPN \"%s\" desconhecido \n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Compilado contra biblioteca SSL sem suporte Cisco DTLS\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Falhou ao processar URL do servidor '%s'\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Só é permitido https:// no URL do servidor\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Sem gestor de formulário, impossível autenticar.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr "Falha no CommandLineToArgvW(): %s\n"
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr "Erro fatal na gestão da linha de comando\n"
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "Falha em ReadConsole(): %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Erro ao converter entrada da consola: %s\n"
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Falha na alocação da cadeia de stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -2002,25 +2045,21 @@ msgstr ""
 "Para assistência do OpenConnect, por favor, veja a página web em\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "A usar OpenSSL. Funcionalidades presentes:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "A usar GnuTLS. Funcionalidades presentes:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "MOTOR OpenSSL não está presente"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "utilizar OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2029,31 +2068,31 @@ msgstr ""
 "\n"
 "AVISO:sem suporte DTLS neste binário. O desempenho será prejudicado.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Impossível processar este caminho executável \"%s\""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Falha na alocação do caminho para vpnc-script\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Substituir nome de máquina \"%s\" por \"%s\"\n"
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Utilização:  openconnect [opções] <servidor>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2062,308 +2101,308 @@ msgstr ""
 "Cliente aberto para Cisco AnyConnect VPN, versão %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Ler opções do ficheiro de configuração"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Continuar nos bastidores após arranque"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Escrever a PID do daemon neste ficheiro"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Usar o certificado CERT do cliente SSL"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Avisar quando a vida útil do certificado for < DIAS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Usar ficheiro de chave privada SSL CHAVE"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Usar cookie WebVPN COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Ler cookie da entrada padrão"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Ativar compressão (padrão)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Desativar compressão"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Definir intervalo mínimo Dead Peer Detection"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Definir grupo de utilizadores da sessão"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Mostrar texto de ajuda"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Usar IFNAME na interface de túnel"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Usar diário de sistema para mensagens de progresso"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Acrescentar carimbo a mensagens de progresso"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Largar privilégios após ligar"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Largar privilégios durante a execução de CSD"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Executar SCRIPT em vez do binário CSD"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indicar caminho MTU de/para o servidor"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Definir frase-passe ou PIN TPM SRK"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Frase-passe da chave é fsid do sistema de ficheiros"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Definir servidor de proxy"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Definir métodos de autenticação do proxy"
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Desativar proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Usar libproxy para configurar o proxy automaticamente"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTA: libproxy desativado nesta compilação)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Requer secretismo de reencaminhamento perfeito"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Menos saída"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Definir limite de fila de pacotes para COMP pacotes"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Terminal de linha de comando para uso com script de configuração vpnc "
 "compatível"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "padrão"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Passar tráfego ao programa de script, não \"tun\""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Definir nome de utilizador"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Relatar número da versão"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Mais saída"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Despejar tráfego de autenticação HTTP (implica --verbose)"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Ficheiro de configuração XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Escolha seleção de autenticação de sessão"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Autenticar só e imprimir informação de sessão"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Obter só cookie webvpn; não ligar"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Imprimir cookie webvpn antes de ligar"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Ficheiro cert para verificação do servidor"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Não pedir ligação IPv6"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Cifras OpenSSL a suportar para DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Desativar DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Desativar reutilização de ligação HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Desativar autenticação por senha/SecuID"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Não pedir validade de certificado SSL do servidor"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Desativar autoridades certificadoras predefinidas do sistema"
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Não tentar autenticação XML POST"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Não esperar entrada do utilizador; sair se for necessária"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Ler senha da entrada padrão"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Tipo de símbolo de programa: rsa, totp ou hotp"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Segredo do símbolo de programa"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(NOTA: libstoken (RSA SecurID) desativado nesta compilação)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(NOTA: Yubikey OATH desativado nesta compilação)"
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Tempo de nova tentativa em segundos"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Impressão digital SHA1 do certificado do servidor"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Cabeçalho HTTP User-Agent: campo"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Usar IP ao ligar a MÁQUINA"
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Tipo de OS (linux,linux-64,win,...) a reportar"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Definir porta local para datagrams DTLS"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Falha ao alocar a cadeia\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Falha ao obter linha do ficheiro de configuração: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Opção não reconhecida na linha %d: \"%s\"\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "A opção \"%s\" não aceita o argumento na linha %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "A opção \"%s\" requer um argumento na linha %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2374,7 +2413,7 @@ msgstr ""
 "         a iconv mas parece estar a usar o conjunto de caracteres\n"
 "         antigo \"%s\". Espere coisas estranhas.\n"
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2383,42 +2422,42 @@ msgstr ""
 "AVISO: esta versão do openconnect é %s mas\n"
 "         a biblioteca libopenconnect é %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Falha ao alocar estrutura vpninfo\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Impossível usar a opção \"config\" no ficheiro de configuração\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Impossível abrir o ficheiro \"%s\": %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Modo de compressão \"%s\" inválido\n"
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Dois pontos (:) em falta na opção de resolução\n"
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Falha ao alocar a memória\n"
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d demasiado pequeno\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2428,125 +2467,132 @@ msgstr ""
 "keepalive.\n"
 "Se ajudar, por favor, reporte em <openconnect-devel@lists.infradead.org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Comprimento 0 na fila não é permitido; a usar 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "Versão OpenConnect %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Modo de símbolo de programa \"%s\" inválido\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Identidade OS \"%s\" inválida\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Demasiados argumentos na linha de comando\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Nenhum servidor especificado\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Esta versão do openconnect foi compilada sem suporte a libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Erro ao abrir o canal cmd\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Falha ao obter o cookie WebVPN\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Falhou ao criar a ligação SSL\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Falha na definição de DTLS; a usar SSL ao invés\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Sem argumento --script indicado; DNS e routing não estão configurados\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Veja http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Falhou ao abrir '%s' para escrita: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "A continuar nos bastidores; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Re-ligação pedida pelo utilizador\n"
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "O cookie foi rejeitado ao religar; a sair.\n"
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Sessão terminada pelo servidor; a sair.\n"
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Cancelada pelo utilizador (SIGINT); a sair.\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Utilizador desanexado da sessão (SIGHUP); a sair.\n"
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Erro desconhecido; a sair.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Falhou ao abrir %s para escrita: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Falhou ao escrever configuração em %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "O certificado do servidor SSL não correspondeu: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2557,90 +2603,101 @@ msgstr ""
 "Certificado do servidor VPN \"%s\" falhou a verificação.\n"
 "Razão_: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Insira \"%s\" para aceitar, \"%s\" para abortar; qualquer outra para ver: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "não"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "sim"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Hash da chave do servidor: %s\n"
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Escolha de autenticação \"%s\" coincide com múltiplas opções\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Escolha de autenticação \"%s\" indisponível\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Requerida entrada do utilizador em modo não interativo\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Falha ao abrir ficheiro de símbolo para escrita: %s\n"
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Falha ao escrever símbolo: %s\n"
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Cadeia suave de símbolo é inválida\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Não consegue abrir o ficheiro ~/.stokenrc\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "O OpenConnect não foi compilado com suporte a libstoken\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Falha geral em libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "O OpenConnect não foi compilado com suporte a liboath\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Falha geral em liboath\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Símbolo Yubikey não encontrado\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "O OpenConnect não foi compilado com suporte a Yubikey\n"
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Falha geral de Yubikey: %s\n"
@@ -2655,16 +2712,16 @@ msgstr "Falha na definição do script tun\n"
 msgid "Set up tun device failed\n"
 msgstr "Falha na definição do dispositivo tun\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Chamador pausou a ligação\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Nada para fazer; a descansar durante %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "Falha em WaitForMultipleObjects: %s\n"
@@ -2731,7 +2788,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "A gerar código de símbolo OATH TOTP\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "A gerar código de símbolo OATH HOTP\n"
 
@@ -2863,512 +2920,629 @@ msgstr "Obtida mensagem KMP %d de tamanho %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Recebidos TLVs não ESP (grupo %d) em negociação ESP KMP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Erro ao criar pedido de negociação oNCP\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Escrita curta em negociação oNCP\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Lidos %d bytes de registo SSL\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Resposta inesperada de tamanho %d após pacote de nome de máquina\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Resposta do servidor ao nome de máquina é erro 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Pacote inválido à espera para KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Esperada mensagem KMP 301 do servidor, obtida %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "Mensgem KMP 301 do servidor demasiado grande (%d bytes)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Obtida mensagem KMP 301 de comprimento %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Falha ao ler comprimento de registo de continuação\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "Registo de %d bytes adicionais demasiado grande; faria %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Falha ao ler comprimento %d do registo de continuação\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Lidos %d bytes adicionais da mensagem KMP 301\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Erro ao negociar chaves ESP\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "nova chegada"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "nova saída"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "A ignorar chaves ESP por o suporte a ESP não estar disponível nesta "
 "compilação\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Lido só 1 byte do campo de comprimento de oNCP\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "O servidor terminou a ligação (sessão expirada)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "O servidor terminou a ligação (motivo: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "O servidor enviou um registo oNCP de comprimento zero\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "Mensagen KMP chegada %d de tamanho %d (obtido %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 "Continuando a processar a mensagem KMP %d agora de tamanho %d (obtido %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Pacote de dados não reconhecido\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Mensagem KMP %d de tamanho %d desconhecida:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d mais bytes não recebidos\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Pacote de saída:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Enviado pacote de ativação de controlo ESP\n"
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "ERRO: %s() chamado com UTF-8 inválido para o argumento \"%s\"\n"
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Falha ao criar SSL_SESSION ASN.1 para OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "O OpenSSL falhou o processamento de SSL_SESSION ASN 1\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Falhou ao iniciar a sessão DTLSv1\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Falhou a inicialização de DTLSv1 CTX\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Falhou a definição da lista de cifras DTLS\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Não é precisamente uma cifra DTLS\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() falhou com o antigo protocolo versão 0x%x\n"
+"Você está ausar uma versão do OpenSSL anterior do que a 0.9.8m?\n"
+"Consulte http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Utilize a opção de linha de comando --no-dtls para evitar esta mensagem\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "Estabelecida ligação DTLS (usando OpenSSL). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"O seu OpenSSL é anterior ao que acabou de compilar, por isso pode falhar o "
+"DTLS!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Isto é provavelmente porque o seu OpenSSL está quebrado\n"
+"Veja http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Cumprimento DTLS falhou:%d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Falhou ao inicializar cifra ESP\n"
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr "Falhou ao inicializar ESP HMAC\n"
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr "Falha ao gerar chaves aleatórias para ESP:\n"
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr "Falha ao configurar contexto de descrição para pacote ESP:\n"
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr "Falha ao desencriptar pacote ESP:\n"
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr "Falha ao gerar IV aleatório para pacote ESP:\n"
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr "Falha ao configurar contexto de encriptação para pacote ESP:\n"
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr "Falha ao encriptar pacote ESP:\n"
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr "Falha ao estabelecer contexto PKCS#11:\n"
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr "Falha ao carregar módulo de fornecedor PKCS#11 (%s):\n"
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN trancado\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN expirado\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Já há outro utilizador em sessão\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr "Erro desconhecido ao iniciar sessão no símbolo PKCS#11\n"
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr "Sessão iniciada em PKCS#11 \"%s\"\n"
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr "Falha ao enumerar certificados na tomada PKCS#11 \"%s\"\n"
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr "Encontrados %d certificadoss em \"%s\"\n"
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr "Falha ao processar URL do servidor \"%s\"\n"
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr "Falha ao processar ficheiro PKCS#12: %s\n"
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr "A usar chave PKCS#11 %s\n"
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "Conteúdo do certificador X.509 não obtido por libp11\n"
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Falha ao instalar certificado no contexto OpenSSL\n"
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr "Falha ao carregar chave privada como PKCS#8: %s\n"
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr "Encontrada %d chaves em \"%s\"\n"
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr "Falha ao carregar chave privada como PKCS#8: %s\n"
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr "Falha ao adicionar a chave de TPM\n"
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Esta versão de OpenConnect foi compilada sem suporte de PSKC\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Falha ao escrever na tomada SSL\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Falha ao ler da tomada SSL\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Erro de leitura SSL %d (o servidor provavelmente fechou a ligação); a "
 "religar.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write falhou: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Tipo %d de pedido SSL UI não gerido\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Senha PEM demasiado comprida (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Certificado extra de %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Falhou processamento PKCS#12 (consultar erros acima)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 não continha um certificado!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 não continha uma chave privada!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Não consegue carregar o motor TPM.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Falhou iniciar o motor TPM\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Falhou ao definir a senha TPM SRK\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Falhou carregar a chave privada TPM\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Falhou adicionar a chave de TPM\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Falhou ao abrir o ficheiro de certificado %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Falhou ao carregar o certificado\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Falha ao processar todos os certificados de suporte. A tentar mesmo "
 "assim...\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "Ficheiro PEM"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Falha ao criar BIO para item \"%s\"\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Falhou carregar chave privada (senha errada?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Falhou carregar a chave privada (consultar erros acima)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Falha ao carregar certificado X509 da loja\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Falha ao usar certificado X509 da loja\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Falha ao usar chave privada da loja\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Falhou ao abrir o ficheiro de chave privada %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Falha ao carregar chave privada\n"
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 "Falhou a identificação do tipo de chave privada em '%s'\n"
 "\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Nome DNS alternativo \"%s\" encontrado\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Nome DNS alternativo \"%s\" não encontrado\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 "O certificado tem nome alternativo GEN_IPADD com comprimento falso %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Correspondeu %s do endereço '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Sem correspondências do endereço %s '%s':\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' tem um caminho não vazio; será ignorado\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "URI correspondido '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Sem correspondências do URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 "Sem correspondências para nome alternativo \"%s\" de certificado do par\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Sem nome de assunto no certificado do par!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Falha ao processar nome de assunto no certificado do par\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Assunto no certificado do par incorreto (\"%s\" != \"%s\")\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Encontrado nome de assunto \"%s\" no certificado do par\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Certificado extra do catfile: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Erro no campo notAfter do certificado do cliente\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Falha ao ler certificados de ficheiro CA \"%s\"\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Falhou ao abrir ficheiro CA '%s'\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "falha na ligação SSL\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Falha ao alocar a cadeia\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Descarte de má divisão inclui: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Descarte de má divisão exclui: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Falha ao espalhar script \"%s\" para %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Script \"%s\" saiu anormalmente (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Script \"%s\" devolveu o erro %d\n"
@@ -3666,85 +3840,97 @@ msgstr "Formato de PIN inválido; tente nvamente.\n"
 msgid "Generating RSA token code\n"
 msgstr "A gerar código de símbolo RSA\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Erro ao aceder à chave de registo para adaptadores de rede\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "A ignorar ambiente TAP \"%s\" não correspondente\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Sem adaptadores Windows-TAP. Tem o controlador instalado?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Falha ao abrir %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Dispositivo tun %s aberto\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Falha ao obter versão do controlador TAP: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Erro: controlador TAP-Windows v9.9 ou superior requerida (encontrada %ld."
 "%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Falha ao definir endereço IP TAP: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Falha ao definir estado do suporte TAP: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "O dispositivo TAP abortou a ligação. A desligar.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Falha ao ler do dispositivo TAP: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Falha ao ler completamente o dispositivo TAP: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Escritos %ld bytes no tun\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "A aguardar pela escrita tun...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Escritos %ld bytes no tun após esperar\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Falha ao escrever no dispositivo TAP: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Espalhar scripts de túnel ainda não é suportado em Windows\n"
 
diff --git a/po/pt_BR.po b/po/pt_BR.po
index cd7f2ee3..c23e3979 100644
--- a/po/pt_BR.po
+++ b/po/pt_BR.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2013-01-18 22:04+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Portuguese (Brazil) <l10n-pt-br@meego.org.br>\n"
@@ -173,7 +173,7 @@ msgstr "Requisitou senha, mas \"--no-passwd\" está definido\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Não será baixado perfil XML porque SHA1 já corresponde\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Falhou ao abrir conexão HTTPS para %s\n"
@@ -314,554 +314,485 @@ msgstr "(Erro ao descrever erro!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "ERRO: Não foi possível inicializar sockets\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "ERRO CRÍTICO: segredo mestre DTLS está não inicializado. Por favor, relate "
 "isso.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Erro ao criar requisição de HTTPS CONNECT\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Erro ao obter resposta HTTPS\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Serviço VPN indisponível - motivo: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Obteve resposta HTTP CONNECT inapropriável: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Obteve resposta CONNECT: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Sem memória suficiente para as opções\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<suprimido>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID não tem 64 caracteres - tem: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "DTLS-Content-Encoding desconhecido %s\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "CSTP-Content-Encoding desconhecido %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Nenhum MTU foi recebido. Abortando\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Nenhum endereço IP recebido. Abortando\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Configuração IPv6 recebido, mas MTU %d é muito pequeno.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Reconexão deu um endereço IP legado diferente (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Reconexão deu uma máscara de rede IP legado diferente (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Reconexão deu uma máscara de rede IPv6 diferente (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Reconexão deu um endereço IPv6 diferente (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP conectado. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "Ciphersuite CTSP: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Configuração da compressão falhou\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Alocação da buffer de deflate falhou\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "falhou ao inflar\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Descompressão LZS falhou: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Descompressão LZ4 falhou\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Tipo de compressão desconhecida %d\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Recebeu o pacote de dados comprimido %s de %d bytes (era %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "deflate falhou %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Alocação falhou\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Pacote curto recebido (%d bytes)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Tamanho de pacote inesperado. SSL_read retornou %d, mas o pacote é\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Obtendo requisição DPD de CSTP\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Obteve resposta DPD CSTP\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Obteve keepalive CSTP\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Recebeu pacote de dados sem compressão de %d bytes\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Recebeu desconexão do servidor: %02x \"%s\"\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Recebeu desconexão do servidor\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Pacote comprimido recebido em modo !deflate\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "recebeu pacote de terminação do servidor\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Pacote desconhecido %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL não escreveu bytes suficiente! Perguntou por %d, enviou %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Renovação da chave CSTP falhou\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Re-negociação falhou; tentando novo túnel\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "Dead Peer Detection CSTP detectou par morto!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Reconexão falhou\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Enviar DPD CSTP\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Enviar keepalive CSTP\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Enviando pacote de dados comprimido de %d bytes (era %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Enviando pacote de %d bytes comm dados não comprimidos\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Enviar pacote BYE: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Tentando autenticação Digest ao proxy\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Tentando autenticação Digest ao servidor \"%s\"\n"
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr "Falha ao criar ASN.1 de SL_SESSION para OpenSSL: %s\n"
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr "Falha do OpenSSL ao analisar ASN.1 de SL_SESSION\n"
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "A inicialização da sessão de DTLSv1 falhou\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Inicialização de DTLSv1 CTX falhou\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "A definição da lista de cifras DTLS falhou\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Não exatamente uma cifra DTLS\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() falhou com versão antiga de protocolo 0x%x\n"
-"Você está usando uma versão do OpenSSL mais antiga do que 0.9.8m?\n"
-"Veja http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use a opção de linha de comando --no-dtls para evitar esta mensagem\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "Conexão DTLS estabelecida (usando OpenSSL). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr "Compressão de conexão DTLS usando %s.\n"
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Seu OpenSSL é mais antigo do que aquele com o qual se compilou o OpenConnect "
-"e, portanto, DTLS pode falhar!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "Limite de tempo para negociação DTLS\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Isso é provavelmente porque o seu OpenSSL está quebrado\n"
-"Veja http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "A negociação DTLS falhou: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Parâmetros DTLS desconhecidos para a CipherSuite requisitada \"%s\"\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Falhou ao definir a prioridade DTLS: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Falhou ao definir os parâmetros de sessão DTLS: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Falhou ao definir o MTU DTLS: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Conexão DTLS estabelecida (usando GnuTLS). Ciphersuite %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Negociação DTLS falhou: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(Há algum firewall impedindo que você envie pacotes UDP?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "Conexão DTLS tentada com um descritor de arquivo existente\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Nenhum endereço DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "O servidor ofereceu nenhuma opção de cifra DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Nenhum DTLS quando conectado via proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Opção DTLS %s: %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS inicializado. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Tentar nova conexão DTLS\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Recebido pacote DTLS 0x%02x de %d bytes\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Obteve requisição de DPD DTLS\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Falhou ao enviar resposta de DPD. Esperar desconexão\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Obteve resposta de DPD DTLS\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Obteve keepalive DTLS\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 "O pacote comprimido DTLS recebido quando a compressão não está habilitada\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Tipo de pacote DTLS desconhecido %02x, tamanho %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Renovação da chave DTLS expirou\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "A re-negociação DTLS falhou - reconectando.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "Dead Peer Detection DTLS detectou par morto!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Enviar DPD DTLS\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Falha ao enviar requisição DPD. Esperar desconexão\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Enviar keepalive DTLS\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Falhou ao enviar requisição de keepalive. Esperar desconexão\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Pacote desconhecido (tamanho %d) recebido: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS obteve erro de escrita %d. Voltando para SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS obteve erro de escrita: %s. Voltando para SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Enviou pacote DTLS de %d bytes - Envio de DTLS retornou %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
-msgstr "Operação SSL cancelada\n"
-
-#: dtls.c:1169
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Iniciando detecção de MTU de IPv4 (min=%d, máx=%d)\n"
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
-msgstr "Tempo muito longo no loop de detecção de MTU; desistindo.\n"
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:531
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
-msgstr "Falha ao enviar requisição DPD (%d): %s\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
+msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
+msgstr ""
+
+#: dtls.c:544
+#, c-format
+msgid "Failed to send DPD request (%d %d)\n"
+msgstr ""
+
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr "Recebido pacote (%.2x) inesperado na detecção de MTU; ignorando.\n"
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
-msgstr "Falha ao receber requisição DPD (%d): %s\n"
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
+
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Iniciando detecção MTU de IPv6\n"
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "Detectado MTU de %d bytes (era %d)\n"
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Nenhuma alteração no MTU após detecção (era %d)\n"
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr "Aceitando pacote ESP esperado com seq %u\n"
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Descartando pacote ESP antigo com seq %u (esperava %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr ""
+"Aceitando pacote ESP depois do esperado com seq %u (esperava %<PRIu64>)\n"
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Aceitando pacote ESP problemático com seq %u (esperava %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Descartando pacote ESP antigo com seq %u (esperava %<PRIu64>)\n"
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr "Descartando replay de pacote ESP com seq %u\n"
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr ""
-"Aceitando pacote ESP depois do esperado com seq %u (esperava %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Aceitando pacote ESP problemático com seq %u (esperava %<PRIu64>)\n"
 
 #: esp.c:68
 #, c-format
@@ -962,6 +893,97 @@ msgstr "Falha ao enviar pacote ESP: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Enviado pacote ESP de %d bytes\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Parâmetros DTLS desconhecidos para a CipherSuite requisitada \"%s\"\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Falhou ao definir a prioridade DTLS: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Falhou ao definir os parâmetros de sessão DTLS: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Falhou ao definir o MTU DTLS: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Conexão DTLS estabelecida (usando GnuTLS). Ciphersuite %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr "Compressão de conexão DTLS usando %s.\n"
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "Limite de tempo para negociação DTLS\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Negociação DTLS falhou: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(Há algum firewall impedindo que você envie pacotes UDP?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -982,7 +1004,7 @@ msgstr "Falha ao gerar chaves aleatórias para ESP: %s\n"
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr "Falha ao calcular HMAC para pacote ESP: %s\n"
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr "Recebido pacote ESP com HMAC inválido\n"
 
@@ -1001,7 +1023,7 @@ msgstr "Falha ao gerar pacote IV ESP: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Falha ao criptografar pacote ESP: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Escrita SSL cancelada\n"
 
@@ -1010,488 +1032,492 @@ msgstr "Escrita SSL cancelada\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Falhou ao escrever em socket SSL: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Leitura SSL cancelada\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "Socket SSL fechado inadequadamente\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Falhou ao ler de socket SSL: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Erro de leitura SSL: %s - reconectando.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "Falha de leitura SSL: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Não foi possível extrair o tempo de expiração do certificado\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Certificado do cliente expirou em"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Certificado do cliente expira em breve em"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Falhou ao carregar item \"%s\" da keystore: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Falhou ao abrir o arquivo de chave/certificado %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Falhou ao obter estado do arquivo de chave/certificado %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Falhou ao alocar buffer do certificado\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Falha ao ler certificado para a memória: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Falhou ao configurar estrutura de dados PKCS#12: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Falhou ao descriptografar arquivo de certificado PKCS#12\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Digite uma frase secreta PKCS#12:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Falhou ao processar arquivo PKCS#12: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Falhou ao ler certificado PKCS#12: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Importação de certificado X509 falhou: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Configuração de certificado PKCS#11 falhou: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Não foi possível inicializar o hash MD5: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "Erro no hash MD5: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Faltando o cabeçalho DEK-Info: da chave criptografada em OpenSSL\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Não foi possível determinar o tipo de criptografia de PEM\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Tipo de criptografia PEM não suportada: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Sal inválido no arquivo PEM criptografado\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Erro na decodificação base64 de arquivo PEM criptografado: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Arquivo PEM criptografado muito curto\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Falhou ao inicializar cifra para descriptografar arquivo PEM: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Falhou ao descriptografar chave PEM: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Descriptografia de chave PEM falhou\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Digita a frase secreta de PEM:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Esse binário compilado sem suporte a chave do sistema\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Esse binário compilado sem suporte a PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Usando certificado PKCS#11 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "Usando certificado do sistema %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Erro no carregamento de certificado de PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Erro no carregamento de certificado do sistema: %s\n"
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Usando arquivo de certificado %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "O arquivo PKCS#11 continha nenhum certificado\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Nenhum certificado encontrado no arquivo"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "O carregamento de certificado falhou: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "Usando chave do sistema %s\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Erro na inicialização da estrutura de chave privada: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Erro na importação da chave de sistema %s: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "Tentando a URL de chave PKCS#11 %s\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Erro na inicialização da estrutura de chave PKCS#11: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Erro na importação da URL PKCS#11 %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Usando chave PKCS#11 %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 "Erro na importação de chave PKCS#11 para a estrutura de chave privada: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Usando arquivo de chave privada %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Essa versão de OpenConnect foi compilada sem suporte a TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Falhou ao interpretar arquivo PEM\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Falhou ao carregar chave privada PKCS#1: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Falhou ao carregar chave privada como PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Falhou ao descriptografar arquivo de certificado PKCS#8\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Falhou ao determinar o tipo da chave privada %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Digite uma frase secreta PKCS#8:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Falhou ao obter ID da chave: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Erro na assinatura de dados de teste com a chave privada: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Erro na validação da assinatura contra certificado: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Nenhum certificado SSL encontrado para conferir a chave privada\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Usando certificado \"%s\" do cliente\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "A configuração da lista de revogação de certificados falhou: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Ocorreu falha ao alocar memória para certificado\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "AVISO: GnuTLS retornou certificados de emissor incorreto - a autenticação "
 "pode falhar!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "Próxima AC \"%s\" obtida de PKCS11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Falhou em alocar memória para certificados de apoio\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Adicionando AC de apoio \"%s\"\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "A configuração de certificado falhou: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "O servidor apresentou nenhum certificado\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr "Erro na comparação do certificado do servidor na re-negociação: %s\n"
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "O servidor apresentou um certificado diferente na re-negociação\n"
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "O servidor apresentou um certificado idêntico na re-negociação\n"
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Erro na inicialização da estrutura de certificado X509\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Erro na importação do certificado do servidor\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Não foi possível calcular hash do certificado do servidor\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Erro na verificação do estado do certificado do servidor\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certificado revogado"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "assinado não encontrado"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "assinador não é um certificado de AC"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "algoritmo inseguro"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certificado não ativado ainda"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certificado expirou"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "verificação da assinatura falhou"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certificado não confere com o hostname"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Verificação do certificado do servidor falhou: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Falhou ao alocar memória para certificados do CAfile\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Falhou ao ler certificados do CAfile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Falhou ao abrir o CAfile \"%s\": %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Carregamento do certificado falhou. Abortando.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Falha ao definir string de prioridade TLS (\"%s\"): %s\n"
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Negociação SSL com %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Conexão SSL cancelada\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Falha de conexão SSL: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Retorno não fatal do GnuTLS durante negociação: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Conectado a HTTPS em %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Renegociou SSL em %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN necessário para %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "PIN incorreto"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Essa é a tentativa final antes de travar!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Somente poucas tentativas restantes antes de travar!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Insira o PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Algoritmo HMAC de OATH sem suporte\n"
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Falha ao calcular HMAC de OATH: %s\n"
@@ -1688,7 +1714,7 @@ msgstr "Tentando autenticação Básica de HTTP para o proxy\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Tentando autenticação Básica de HTTP ao servidor \"%s\"\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Essa versão de OpenConnect foi compilada sem suporte a GSSAPI\n"
 
@@ -1709,237 +1735,237 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Sem mais métodos de autenticação para tentar\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Nenhuma memória para alocação de cookies\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Falhou ao analisar resposta HTTP \"%s\"\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Obteve resposta HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Erro no processamento da resposta HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ignorando linha de resposta HTTP desconhecida \"%s\"\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Cookie inválido oferecido: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Autenticação de certificado SSL falhou\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Corpo da resposta possui tamanho negativo (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Transfer-Encoding negativo: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "Corpo de HTTP %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Erro na leitura do corpo da resposta HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Erro ao obter cabeçalho do bloco\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Erro ao obter corpo de resposta HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Erro na decodificação fragmentada. Esperava \"\", obteve: \"%s\""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Não foi possível receber corpo de HTTP 1.0 sem fechar a conexão\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Falhou ao analisar URL redirecionada \"%s\": %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Não foi possível seguir o redirecionamento para URL não https \"%s\"\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "A alocação de novo caminho para redirecionamento relativo falhou: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Resultado inesperado %d do servidor\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "requisição concedida"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "falha geral"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "conexão não permitida pelo conjunto de regras"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "a rede está inacessível"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "o host está inacessível"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "Conexão recusada pelo host de destino"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL expirou"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "comando não suportado / erro de protocolo"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "tipo de endereço não suportado"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "O servidor SOCKS requisitou nome de usuário e senha, mas temos nenhum\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "Nome de usuário e senha para autenticação SOCKS devem ser < 255 bytes\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Erro na escrita de requisição de autenticação para proxy SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Erro na leitura de reposta de autenticação de proxy SOCKS: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Resposta de autenticação inesperada de proxy SOCKS: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Autenticou para o servidor SOCKS usando senha\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Autenticação por senha para o servidor SOCKS falhou\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "O servidor SOCKS requisitou autenticação por GSSAPI\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "O servidor SOCKS requisitou autenticação por senha\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "O servidor SOCKS requer autenticação\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "O servidor SOCKS requisitou tipo de autenticação desconhecida %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Requisitando conexão ao proxy SOCKS para %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Erro na escrita de requisição de conexão para proxy SOCKS: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Erro na leitura de resposta de conexão de proxy SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Resposta de conexão inesperada de proxy SOCKS: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Erro de proxy SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Erro de proxy SOCKS %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Tipo de endereço %02x inesperado na resposta de conexão SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Requisitando conexão proxy HTTP para %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Envio de requisição proxy falhou: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Requisição de proxy CONNECT falhou: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Tipo de proxy desconhecido \"%s\"\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Somente proxy http ou socks(5) são suportados\n"
 
@@ -1952,45 +1978,62 @@ msgstr "Protocolo VPN desconhecido \"%s\"\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Compilado com biblioteca SSL sem suporte a DTLS da Cisco\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Falhou ao analisar URL do servidor \"%s\"\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Somente https:// é permitido como URL de servidor\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "nenhum manipulador de forma - não foi possível autenticar.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr "CommandLineToArgvW() falhou: %s\n"
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr "Erro fatal ao manipular a linha de comando\n"
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() falhou: %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Erro ao converter a entrada de console: %s\n"
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Falha ao alocar de string da stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1999,25 +2042,21 @@ msgstr ""
 "Para assistência com OpenConnect, por favor veja a página web em\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Usando OpenSSL. Recursos presentes:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Usando GnuTLS. Recursos presentes:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL ENGINE não presente"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "usando OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2026,31 +2065,31 @@ msgstr ""
 "\n"
 "AVISO: nenhum suporte a DTLS neste binário. A performance será prejudicada.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Não foi possível processar este caminho de executável \"%s\""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Alocação para caminho de vpnc-script falhou\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Substituição hostname \"%s\" com \"%s\"\n"
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Uso:  openconnect [opções] <servidor>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2059,308 +2098,308 @@ msgstr ""
 "Cliente aberto para Cisco AnyConnect VPN, versão %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Lê as opções do arquivo de configuração"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Continua em plano de fundo após inicialização"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Escreve o PID do daemon neste arquivo"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Usa o certificado CERT do cliente SSL"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Avisa quando o tempo de vida do certificado < DAYS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Usa o arquivo KEY de chave privada SSL"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Usa o cookie COOKIE de WebVPN"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Lê o cookie da entrada padrão"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Habilita compressão (padrão)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Desabilita compressão"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Define um intervalo mínimo de Dead Peer Detection"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Define o grupo de usuário do login"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Exibe o texto de ajuda"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Usa IFNAME para a interface do túnel"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Usa syslog para as mensagens de progresso"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Prefixa marca de tempo nas mensagens de progresso"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Descarta privilégios após conexão"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Descarta privilégios durante execução de CSD"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Executa SCRIPT ao invés do binário do CSD"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indica MTU do caminho de/para o servidor"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Define a frase secreta chave ou TPM SRK PIN"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Frase secreta chave é fsid do sistema de arquivos"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Define o servidor proxy"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Define os métodos de autenticação de proxy"
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Desabilita o proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Usa libproxy para configurar automaticamente o proxy"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTA: libproxy desabilitado nesta compilação)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Exige perfect forward secrecy (PFS)"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Menos saída"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Define limite da fila de pacotes para LEN pkts"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Linha de comando shell para usar um script de configuração compatível com "
 "vpnc"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "padrão"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Passa tráfego para o programa \"script\", ao invés do tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Define o nome de usuário do login"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Informa o número da versão"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Mais saída"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Despeja o tráfego de autenticação HTTP (--verbose implícito)"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Arquivo de configuração XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Escolhe a seleção de login para autenticação"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Só autentica e imprime informação de login"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Só obtém cookie de webvpn - não conecta"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Imprime o cookie de webvpn antes de conectar."
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Arquivo de certificado para verificação do servidor"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Não solicita conectividade em IPv6"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Cifras de OpenSSL a serem suportadas para DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Desabilita DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Desabilita reuso de conexão HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Desabilita autenticação por senha/SecurID"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Não exige que o certificado SSL do servidor seja válido"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Desabilita autoridades certificadoras padrão do sistema"
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Não tenta autenticação XML POST"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Não espera entrada do usuário - sai se for requisitado"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Lê senha da entrada padrão"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Tipo de token de software: rsa, totp ou hotp"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Segredo de token de software"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(NOTA: libstoken (RSA SecurID) desabilitado nesta compilação)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(NOTA: Yubikey OATH desabilitado nesta compilação)"
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Limite de tempo em segundos para nova tentativa de conexão"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Impressão digital SHA1 do certificado do servidor"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Campo User-Agent: do cabeçalho de HTTP"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Hostname local a ser anunciado ao servidor"
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Usar IP ao conectar ao HOST"
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Tipo de SO (linux,linux-64,mac,win,...) para informar"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Define a porta local para datagramas DTLS"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Falhou ao alocar string\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Falha ao obter linha de arquivo de configuração: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Opção não reconhecida na linha %d: \"%s\"\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Opção \"%s\" não leva um argumento na linha %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Opção \"%s\" requer um argumento na linha %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Usuário inválido \"%s\": %s\n"
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "ID de usuário inválido \"%d\": %s\n"
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2371,7 +2410,7 @@ msgstr ""
 "         a iconv, mas você parece estar usando o conjunto de\n"
 "         caracteres legado \"%s\". Espere coisas estranhas.\n"
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2380,42 +2419,42 @@ msgstr ""
 "AVISO: Essa versão do openconnect é %s, mas\n"
 "         a biblioteca libopenconnect é %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Falha ao alocar a estrutura de vpninfo\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Não é possível usar \"config\" dentro do arquivo de configuração\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Não foi possível usar o arquivo de configuração \"%s\": %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Modo de compressão \"%s\" inválido\n"
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Faltando dois-pontos na opção de resolução\n"
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Falha ao alocar memória\n"
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d é muito pequeno\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2426,126 +2465,133 @@ msgstr ""
 "Se isso ajuda, por favor relate para <openconnect-devel@lists.infradead."
 "org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Fila com tamanho zero não é permitido - usando 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect versão %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Modo de token de software \" %s\" inválido\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Identidade do SO inválida \"%s\"\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Argumentos demais na linha de comando\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Nenhum servidor especificado\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Essa versão do openconnect foi compilada sem suporte a libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Erro ao abrir redirecionamento de comando\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Falha ao obter um cookie de WebVPN\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "A criação da conexão SSL falhou\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "A configuração de DTLS falhou - usando SSL em vez disso\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Conectado como %s%s%s, usando %s%s\n"
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Nenhum argumento --script fornecido - DNS e roteamento não estão "
 "configurados\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Veja http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Falha ao abrir \"%s\" para escrita: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Continuando em plano de fundo - pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Usuário requisitou reconexão\n"
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Cookie rejeitado na reconexão; saindo.\n"
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Sessão terminada pelo servidor; saindo.\n"
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Usuário cancelado (SIGINT); saindo.\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Usuário desanexado da sessão (SIGHUP); saindo.\n"
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Erro desconhecido; saída.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Falha ao abrir %s para escrita: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Falha ao escrever a configuração para %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Certificado SSL do servidor não correspondem: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2556,91 +2602,102 @@ msgstr ""
 "Certificado do servidor VPN \"%s\" falhou na verificação.\n"
 "Motivo: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Digite \"%s\" para aceitar, \"%s\" para abortar ou qualquer outra coisa para "
 "visualizar: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "não"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "sim"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Hash da chave do servidor: %s\n"
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Escolha de autenticação \"%s\" corresponde a múltiplas opções\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Escolha de autenticação \"%s\" não disponível\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Entrada do usuário requisitada em modo não interativo\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Falhou ao abrir arquivo de token para escrita: %s\n"
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Falhou ao escrever token: %s\n"
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "String de token de software é inválida\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Não foi possível abrir o arquivo ~/.stokenrc\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect não foi compilado com suporte a libstoken\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Falha geral no libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect não foi compilado com suporte a libauth\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Falha geral no libauth\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Token Yubikey não encontrado\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "OpenConnect não foi compilado com suporte a Yubikey\n"
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Falha geral no Yubikey: %s\n"
@@ -2655,16 +2712,16 @@ msgstr "A configuração de script tun falhou\n"
 msgid "Set up tun device failed\n"
 msgstr "A configuração de um dispositivo tun falhou\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Chamador parou a conexão\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Nenhum trabalho para fazer - dormindo por %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "WaitForMultipleObjects falhou: %s\n"
@@ -2732,7 +2789,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "Gerando código de token TOTP OATH\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Gerando código de token HOTP OATH\n"
 
@@ -2864,508 +2921,625 @@ msgstr "Obteve mensagem KMP %d de tamanho %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Recebido TLVs (grupo %d) não-ESP em KMP de negociação ESP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Erro ao criar requisição de negociação oNCP\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Escrita curta em negociação oNCP\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Lidos %d bytes de registro SSL\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Resposta inesperada de tamanho %d após pacote de hostname\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Resposta do servidor ao pacote do hostname é erro 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Pacote inválido, esperando por KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Esperava mensagem KMP 301 do servidor, mas obteve %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "Mensagem KMP 301 do servidor muito grande (%d bytes)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Obteve mensagem KMP 301 de comprimento %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Falha ao ler tamanho de registro de continuação\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "Registro de %d bytes adicionais muito grande; resultaria em %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Falha ao ler registro de continuação de tamanho %d\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Lidos %d bytes adicionais de mensagem KMP 301\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Erro ao negociar chaves ESP\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "nova entrada"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "nova saída"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "Ignorando chaves ESP já que suporte a ESP não está disponível nesta "
 "compilação\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Lido apenas 1 byte de campo de comprimento oNCP\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "Servidor terminou a conexão (sessão expirou)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "Servidor terminou a conexão (motivo: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "Servidor enviou registro oNCP de comprimento zero\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "Recebendo mensagem KMP %d de tamanho %d (obteve %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 "Continuando a processar mensagem KMP %d agora com tamanho %d (obteve %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Pacote de dados não reconhecido\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Mensagem KMP desconhecida %d de tamanho %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + mais %d bytes não recebidos\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Pacote de saída:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Enviado pacote de controle com capacidade de ESP\n"
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "ERRO: %s() chamado com UTF-8 inválido para \"%s\" argumento\n"
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Falha ao criar ASN.1 de SL_SESSION para OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "Falha do OpenSSL ao analisar ASN.1 de SL_SESSION\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "A inicialização da sessão de DTLSv1 falhou\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Inicialização de DTLSv1 CTX falhou\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "A definição da lista de cifras DTLS falhou\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Não exatamente uma cifra DTLS\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() falhou com versão antiga de protocolo 0x%x\n"
+"Você está usando uma versão do OpenSSL mais antiga do que 0.9.8m?\n"
+"Veja http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use a opção de linha de comando --no-dtls para evitar esta mensagem\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "Conexão DTLS estabelecida (usando OpenSSL). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Seu OpenSSL é mais antigo do que aquele com o qual se compilou o OpenConnect "
+"e, portanto, DTLS pode falhar!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Isso é provavelmente porque o seu OpenSSL está quebrado\n"
+"Veja http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "A negociação DTLS falhou: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Erro ao inicializar cifra ESP:\n"
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr "Erro ao inicializar HMAC de ESP\n"
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr "Falha ao gerar chaves aleatórias para ESP:\n"
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr "Falha ao configurar contexto de descriptografia para pacote ESP:\n"
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr "Falha ao descriptografar pacote ESP:\n"
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr "Falha ao gerar IV aleatório para pacote ESP:\n"
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr "Falha ao configurar contexto de criptografia para pacote ESP:\n"
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr "Falha ao criptografar pacote ESP:\n"
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr "Falha ao estabelecer contexto PKCS#11 de libp11:\n"
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr "Falha ao carregar módulo provedor de PKCS#11 (%s):\n"
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN travado\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN expirou\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Um outro usuário já está conectado\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr "Erro desconhecido ao conectar ao token PKCS#11\n"
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr "Conectado ao slot PKCS#11 \"%s\"\n"
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr "Falha ao enumerar certificados no slot PKCS#11 \"%s\"\n"
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr "Encontrada %d certificados no slot \"%s\"\n"
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr "Falha ao analisar URI PKCS#11 \"%s\"\n"
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr "Falha ao enumerar slots PKCS#11\n"
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr "Conectando ao slot PKCS#11 \"%s\"\n"
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "Conteúdo de certificado X.509 não obtido por libp11\n"
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Falhou ao instalar certificado em contexto OpenSSL\n"
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr "Falha ao enumerar chaves no slot PKCS#11 \"%s\"\n"
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr "Encontradas %d chaves no slot \"%s\"\n"
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr "Falha ao instanciar chave privada de PKCS#11\n"
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr "Adição de chave de PKCS#11 falhou\n"
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Essa versão do OpenConnect foi compilada sem suporte a PKCS#11\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Falhou ao escrever para socket SSL\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Falhou ao escrever de socket SSL\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Erro de leitura SSL %d (servidor provavelmente fechou a conexão) - "
 "reconectando.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write falhou: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Tipo de requisição de UI SSL não lidada %d\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Senha de PEM muito longa (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Certificado extra de %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Análise de PKCS#12 falhou (veja os erros acima)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 continha nenhum certificado!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 continha nenhuma chave privada!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Não foi possível carregar mecanismo de TMP.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Falhou ao inicializar mecanismo de TMP\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Falhou ao definir senha de SRK TPM\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Falhou ao carregar chave privada de TPM\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Adição de chave de TPM falhou\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Falhou ao abrir arquivo de certificado %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Carregamento de certificado falhou\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Falhou ao processar todos os certificados suportados. Tentando mesmo "
 "assim...\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "Arquivo PEM"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Falhou ao criar BIO para item da keystore \"%s\"\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Carregamento de chave privada falhou (frase secreta incorreta?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Carregamento de chave privada falhou (veja os erros acima)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Falhou ao carregar certificado X509 da keystore\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Falhou ao usar certificado X509 da keystore\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Falhou ao usar chave privada da keystore\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Falhou ao abrir arquivo de chave privada %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Carregamento de chaves privadas falhou\n"
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Falhou ao identificar o tipo de chave privada em \"%s\"\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Correspondeu ao altname DNS de \"%s\"\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Não corresponder para altname de \"%s\"\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "O certificado tem um altname GEN_IPADD com tamanho falho %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Correspondeu o endereço %s a \"%s\"\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Nenhuma correspondência para endereço %s de \"%s\"\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "A URI \"%s\" possui caminho não vazio - ignorando\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Correspondeu a URI \"%s\"\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Nenhuma correspondência com URI \"%s\"\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Nenhum altname no certificado do par correspondeu \"%s\"\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Nenhum nome do sujeito no certificado do par!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Falhou ao analisar nome do sujeito no certificado do par\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Sujeito do certificado do par não confere (\"%s\" != \"%s\")\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Correspondeu ao nome do sujeito \"%s\" do certificado do par\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Certificado extra do CAfile: \"%s\"\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Erro no campo notAfter do certificado do cliente\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<erro>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Falhou ao ler certificados do CAfile \"%s\"\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Falhou ao abrir o CAfile \"%s\"\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Falha de conexão SSL\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Falha ao calcular HMAC de OATH\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Descartar inclusão de split incorreta: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Descartar exclusão de split incorreta: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Falhou ao executar o script \"%s\" para %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "O script \"%s\" saiu anormalmente (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "O script \"%s\" retornou erro %d\n"
@@ -3667,85 +3841,97 @@ msgstr "Formato inválido de PIN - tente novamente.\n"
 msgid "Generating RSA token code\n"
 msgstr "Gerando código de token RSA\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Erro ao acessar chave de registro de adaptadores de rede\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Ignorando interface TAP não correspondente \"%s\"\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Nenhum adaptador TAP do Windows encontrado. O driver está instalado?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Falha ao abrir %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Abriu dispositivo tun %s\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Falhou ao obter versão do driver TAP: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Erro: Driver de TAP do Windows versão v9.9 ou mais recente é necessário "
 "(encontrou %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Falhou ao definir endereços IP TAP: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Falhou ao definir status de mídia TAP: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "Dispositivo TAP abortou conectividade. Desconectando.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Falhou ao ler do dispositivo TAP: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Falhou ao completar leitura do dispositivo TAP: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Escreveu %ld bytes para tun\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Esperando o tun escrever...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Escreveu %ld bytes para tun após espera\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Falhou ao escrever no dispositivo TAP: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Scripts de criação de túnel não têm suporte no Windows\n"
 
diff --git a/po/pt_PT.po b/po/pt_PT.po
index 1fee2da2..8e5b5425 100644
--- a/po/pt_PT.po
+++ b/po/pt_PT.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Portuguese (Portugal) (http://www.transifex.net/projects/p/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ro.po b/po/ro.po
index f31e6ba7..4d23ac61 100644
--- a/po/ro.po
+++ b/po/ro.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Romanian (http://www.transifex.net/projects/p/meego/team/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ru.po b/po/ru.po
index b1ca6af5..d513c8a1 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-20 08:43+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Russian (http://www.transifex.net/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/rw.po b/po/rw.po
index d20b981e..1ba4e708 100644
--- a/po/rw.po
+++ b/po/rw.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Kinyarwanda (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/si.po b/po/si.po
index abc0c42c..26a0ccf4 100644
--- a/po/si.po
+++ b/po/si.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Sinhala (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/sk.po b/po/sk.po
index 2efcea89..fcba4414 100644
--- a/po/sk.po
+++ b/po/sk.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-20 08:43+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Slovak (http://www.transifex.net/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Nebola prijatá žiadna IP adresa. Končím\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/sl.po b/po/sl.po
index 5f2b1a15..3e928d30 100644
--- a/po/sl.po
+++ b/po/sl.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-11-15 08:31+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Slovenian <lugos-slo@lugos.si>\n"
@@ -171,7 +171,7 @@ msgstr "Zahtevano je geslo, vendar je uporabljena zastavica '--no-passwd'\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Napaka med odpiranjem povezave HTTPS %s\n"
@@ -307,561 +307,490 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Napaka med pridobivanjem odziva HTTP\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "Storitev VPN ni na voljo; razlog: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Prejet neustrezen odziv HTTP CONNECT: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Prejet je odziv CONNECT: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Ni pomnilnika za možnosti\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<izpadlo>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "ID seje X-DTLS-Session-ID ni dolžine 64 znakov, ampak: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Neznano kodiranje vsebine CSTP %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "MTU ni bil prejet. Opravilo bo prekinjeno.\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Ni prejetega nobenega naslova IP. Opravilo je preklicano.\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 "S ponovno povezavo je pridobljen drugačen opuščen naslov IP (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "S ponovno povezavo je pridobljena drugačna opuščena maska omrežja IP (%s != "
 "%s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "S ponovno povezavo je pridobljen drugačen naslov IPv6 (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 "S ponovno povezavo je pridobljena drugačna maska omrežja IPv6 (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "Vzpostavljena je povezava CSTP. DPD %d, KEEPALIVE %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Nastavitev stiskanja je spodletela\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Dodelitev medpomnilnika za stiskanje je spodletela\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "razširjanje je spodletelo\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "razširjanje je spodletelo %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Nepričakovana dolžina paketa. SSL_read je vrnil %d, paket pa je\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Prejeta zahteva DPD CSTP\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Pridobljen je odziv CSTP DPD\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Prejet je ukaz KEEPALIVE CSTP\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Prejet je ne-stisnjen paket podatkov velikosti %d bajtov\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Prejeta prekinitev povezave s strežnikom: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Prejet stisnjen paket v načinu !deflate\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "Prejet paket prekinitve strežnika\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Neznan paket %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL je zapisal premalo bajtov! Zahtevanih je %d, poslanih pa %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Protokol CSTP zahteva ponovno preverjanje ključa\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 "Zaznava mrtvih omrežnih soležnikov CSTP je zaznala mrtvega omrežnega "
 "soležnika!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Ponovna povezava je spodletela\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Pošlji zahtevo CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Pošlji zahtevo CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Pošiljanje ne-stisnjenega paketa podatkov velikosti %d bajtov\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Pošlji paket BYE: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Začenjanje seje DTLSv1 je spodletela\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Začenjanje DTLSv1 CTX je spodletelo.\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Nastavljanje seznama šifer DTLS je spodletelo.\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Ni natanko ena šifra DTLS.\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"Predmet SSL_set_session() je spodletel s staro različico protokola 0x%x\n"
-"Ali je v uporabi različica programa OpenSSL, ki je starejša od različice "
-"0.9.8m?\n"
-"Za več podrobnosti si oglejte http://rt.openssl.org/Ticket/Display.html?"
-"id=1751\n"
-"Z uporabo zastavice --no-dtls v argumentu ukaza, se izognete temu sporočilu\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"Različica OpenSSL je starejša kot tisti, s katero je bil program izgrajen, "
-"zato lahko DTLS spodleti!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "Izmenjava signalov DTLS je presegla dovoljeni čas\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Vzrok je najbrž v vašem okvarjenem OpenSSL.\n"
-"Oglejte si http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "Izmenjava signalov DTLS je spodletela: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Neznani parametri DTLS za zahtevani CipherSuite '%s'\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Nastavljanje prednosti DTLS je spodletelo: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Nastavljanje parametrov seje DTLS je spodletelo: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Nastavljanje MTU za DTLS je spodletelo: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "Izmenjava signalov DTLS je spodletela: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Ni naslova DTLS\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Strežnik ni ponudil možnosti šifer DTLS\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Pri povezavi prek posredniškega strežnika, DTLS ni na voljo.\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Možnost DTLS %s: %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS začet. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Poskus nove povezave DTLS\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Prejet je paket DTLS 0x%02x velikosti %d bajtov\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Prejeta zahteva DPD DTLS\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 "Pošiljanje odziva DPD je spodletelo. Pričakovana je prekinitev povezave.\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Prejet je odziv DTLS DPD\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Prejet je ukaz KEEPALIVE DTLS\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Neznana vrsta paketa DTLS %02x, dolžina je %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Ponovno uporaba ključa DTLS je potekla.\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "Zaznava nedejavnih soležnikov je vrnila zadetke nedejavnih povezav!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Pošlji DPD DTLS\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 "Pošiljanje zahteve DPD je spodletelo. Pričakujte prekinitev povezave.\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Pošlji KEEPALIVE DTLS\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 "Pošiljanje zahteve KEEPALIVE je spodletelo. Pričakujte prekinitev povezave.\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Prejet je neznan paket (len %d): %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "Prejeta napaka pisanja DTLS %d. Opravilo bo povrnjeno na SSL.\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "Prejeta napaka pisanja DTLS: %s. Opravilo bo povrnjeno na SSL.\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 "Poslan je bil paket DTLS dolžine %d bajtov; vrnjen paket DTLS pa je %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgstr ""
+
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
+
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -963,6 +892,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Neznani parametri DTLS za zahtevani CipherSuite '%s'\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Nastavljanje prednosti DTLS je spodletelo: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Nastavljanje parametrov seje DTLS je spodletelo: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Nastavljanje MTU za DTLS je spodletelo: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "Izmenjava signalov DTLS je presegla dovoljeni čas\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "Izmenjava signalov DTLS je spodletela: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -983,7 +1003,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -1002,7 +1022,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Zapisovanje SSL je bilo preklicano\n"
 
@@ -1011,487 +1031,491 @@ msgstr "Zapisovanje SSL je bilo preklicano\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Pisanje v vtič SSL je spodletelo: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Branje SSL je bilo preklicano\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Branje z vtiča SSL je spodletelo: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "Napaka branja SSL: %s; sledi ponovna povezava.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "Pošiljanje SSL je spodletelo: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Datuma poteka potrdila ni mogoče izluščiti.\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Potrdilo odjemalca je poteklo dne"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Potrdilo odjemalca poteče ob"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Nalaganje '%s' iz shrambe ključev je spodletelo: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Odpiranje datoteke ključa/potrdila %s je spodletelo: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Ustvarjanje datoteke ključa/potrdila %s je spodletelo: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Dodeljevanje medpomnilnika potrdil je spodletelo\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Branje potrdila v pomnilnik je spodletelo: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Vzpostavitev podatkovne strukture PKCS#12 je spodletela: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Odšifriranje datoteke PKCS#12 je spodletelo\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Vnos šifrirnega gesla PKCS#12:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Obdelava datoteke PKCS#12 je spodletela: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Nalaganje potrdila PKCS#12 je spodletelo: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Uvažanje potrdila X509 je spodletelo: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Nastavljanje potrdila PKCS#11 je spodletelo: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Razprtšila MD5 ni mogoče začeti: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "Napaka razpršila MD5: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Manjkajoči podatki DEK: glava iz šifriranega ključa OpenSSL\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Vrste šifriranja PEM ni mogoče razpoznati\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Nepodprta vrsta šifriranja PEM: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Neveljaven salt v šifrirani datoteki PEM\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Napaka pri odkodiranju BASE64 šifrirane datoteke PEM: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Šifrirana datoteka PEM je prekratka\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Začenjanje šifre za dešifriranje datoteke PEM je spodletelo: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Odšifriranje ključa PEM je spodletelo: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Odšifriranje ključa PEM je spodletelo\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Vnos šifrirnega gesla PEM:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Ta program je izgrajen brez podpore za PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Uporabljeno je potrdilo PKCS#12 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Napaka pri nalaganju potrdila iz PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Uporabljena bo datoteka potrdila %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "Datoteka PKCS#11 ne vsebuje potrdil\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "V datoteki ni mogoče najti potrdila"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Nalaganje potrdila je spodletelo: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Napaka pri začenjanju strukture osebnih ključev: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Napaka pri začenjanju strukture ključev PKCS#11: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Napaka pri uvozu naslova URL %s PKCS#11: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Uporabljen je ključ PKCS#11 %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Napaka pri uvozu ključa PKCS#11 v strukturo osebnih ključev: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Uporaba datoteke zasebnega ključa %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Ta različica programa OpenConnect je izgrajena brez podpore za TPM\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Tolmačenje datoteke PEM je spodletelo\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Nalaganje zasebnega ključa PKCS#1 je spodletelo: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Nalaganje osebnega ključa kot PKCS#8 je spodletelo: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Odšifriranje datoteke potrdila PKCS#8 je spodletelo\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Ni mogoče določiti vrste zasebnega ključa %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Vnos šifrirnega gesla PKCS#8:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Pridobivanje ID ključa je spodletelo: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Napaka pri podpisovanju preizkusnih podatkov z osebnim ključem: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Napaka pri overjanju podpisa s potrdilom: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Z zasebnim ključem se ne ujema nobeno potrdilo SSL\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Uporabljeno bo potrdilo odjemalca '%s'\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Določanje seznama preklicev potrdil je spodletelo: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "OPOZORILO: program GnuTLS je vrnil nepravilno potrdilo izdajatelja; overitev "
 "bo najverjetneje spodletela!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Dodeljevanje pomnilnika podpornim potrdilom je spodletelo\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Dodajanje podpornega CA '%s'\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Nastavljanje potrdila je spodletelo: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Strežnik ni javil podatkov o potrdilu\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Napaka pri začenjanju strukture potrdil X509\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Napaka med uvažanjem potrdila strežnika\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Napaka pri preverjanju stanja potrdila strežnika\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "potrdilo je preklicano"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "podpisnika ni mogoče najti"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "podpisnik ni overitelj potrdila CA"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "algoritem ni varen"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "potrdilo  še ni omogočeno"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "potrdilo je preteklo"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "preverjanje podpisa je spodletelo"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "potrdilo se ne ujema z imenom gostitelja"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Preverjanje potrdila strežnika je spodletelo: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Dodeljevanje pomnilnika podpornim potrdilom je spodletelo\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Ni mogoče prebrati potrdil iz datoteke cafile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Odpiranje datoteke CA '%s' je spodletelo: %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Nalaganje potrdila je spodletelo. Opravilo je prekinjeno.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "Poteka pogajanje SSL z %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Povezava SSL je preklicana\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Povezava SSL je spodletela: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Vrnjena je ne-usodna napaka GnuTLS med izmenjavo signalov: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Vzpostavljena je povezava s HTTPS na %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "Za %s je zahtevana koda PIN"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Napačna koda PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "To je zadnji poskus pred zaklepom!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Ostaja le še nekaj poskusov do zaklepa!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Koda PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1687,7 +1711,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1705,239 +1729,239 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Ni pomnilnika za dodeljevanje piškotkov\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Razčlenjevanje odgovora HTTP '%s' je spodletelo\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Prejet je odziv HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Napaka pri obdelavi odgovora HTTP\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Prezrta bo neznana vrstica odziva HTTP '%s'\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Ponujen je neveljaven piškotek: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Overitev potrdila SSL je spodletela.\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Telo odgovora ima negativno velikost (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Neznano kodiranje prenosa: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "Telo HTTP %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Napaka branja telesa odziva HTTP\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Napaka pri pridobivanju glave sporočila\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Napaka branja telesa odziva HTTP\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Napaka odkodiranja po kosih. Pričakovan je znak '', prejet pa: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Telesa HTTP različice 1.0 brez zapiranja povezave ni mogoče prejeti.\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Razčlenjevanje preusmeritvenega naslova URL '%s' je spodletelo: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 "Preusmeritvi na naslov URL '%s', ki ni vrste HTTPS, ni mogoče slediti\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Dodeljevanje nove poti  za relativno preusmeritev je spodletelo: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Nepričakovan odgovor strežnika %d.\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "zahteva je odobrena"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "splošna napaka"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "nabor pravil ne dovoljuje povezave"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "omrežje ni dosegljivo"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "gostitelj ni dosegljiv"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "povezava je zavrnjena na ciljnem gostitelju"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "Potrdilo TTL je preteklo"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "ukaz ni podprt; napaka protokola"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "vrsta naslova ni ni podprta."
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Napaka pisanja odziva auth s posredniškega strežnika SOCKS: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Napaka branja odziva auth s posredniškega strežnika SOCKS: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 "Nepričakovan odziv povezave posredniškega strežnika SOCKS: %02x %02x...\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Poslana je zahteva povezave s posredniškim strežnikom SOCKS %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 "Napaka zapisovanja zahtev povezave s posredniškim strežnikom SOCKS: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Napaka branja odzivov povezave s posredniškega strežnika SOCKS: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 "Nepričakovan odziv povezave posredniškega strežnika SOCKS: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Napaka posredniškega strežnika SOCKS %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Napaka posredniškega strežnika SOCKS %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Nepričakovana vrsta naslova %02x v odzivu povezave SOCKS\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Poslana je zahteva povezave s posredniškim strežnikom HTTP %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Pošiljanje zahteve posredniškega strežnika je spodletelo: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Neznana vrsta posredniškega strežnika '%s'.\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Podprti so le posredniški strežniki HTTP in SOCKS(5)\n"
 
@@ -1950,70 +1974,83 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Izgrajeno na osnovi knjižnice SSL brez podpore za Cisco DTLS.\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Napaka med razčlenjevanjem naslova URL strežnika '%s'\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Za strežniški naslov URL je dovoljen le protokol https://\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Ni ročnika obrazca; vnosov ni mogoče overiti\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Napaka dodeljevanja za niz s standardnega vhoda\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Uporaba OpenSSL. Možnosti vključujejo:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Uporaba GnuTLS. Možnosti vključujejo:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "Programnik OpenSSL ni na voljo"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "uporaba OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2023,31 +2060,31 @@ msgstr ""
 "OPOZORILO: V tej izvajalni datoteki DTLS ni podprt. Delovanje bo zato "
 "okrnjeno.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Uporaba: openconnect [možnosti] <strežnik>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2056,311 +2093,311 @@ msgstr ""
 "Odprti odjemalec za Cisco AnyConnect VPN, različica %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Preberi možnosti iz nastavitvene datoteke"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Po zagonu nadaljuj v ozadju"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Zapiši PID ozadnjega programa v navedeno datoteko"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Uporabi potrdilo SSL CERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Opozori, ko je življenjska doba potrdila manj kot določeno število dni"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Uporabi zasebno datoteko KEY ključa SSL"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Uporabi piškotek PIŠKOTEK WebVPN."
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Preberi piškotek z navadnega vhoda"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Omogoči stiskanje podatkov (privzeto)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Omnemogoči stiskanje"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Določite najmanjši interval zaznave nedejavnih soležnikov"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Nastavi prijavno uporabniško skupino"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Pokaži besedilo pomoči"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Za vmesnik tunela uporabi IFNAME"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Uporabi sistem syslog za obdelavo sporočil"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Opusti dovoljenja po povezavi"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Opusti dovoljenja med izvajanjem CSD"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Izvedi SCRIPT namesto programa CSD"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Nakaži pot MTU z/na strežnik"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Nastavi šifrirno frazo ali kodo PIN za TPM SRK"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Šifrirno geslo ključa je fsid datotečnega sistema"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Nastavi posredniški strežnik"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Onemogoči posredniški strežnik"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Uporabi libproxy za samodejno nastavljanje posredniškega strežnika"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(Opomba: knjižnica libproxy je v tej izgradnji onemogočena)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Manj podroben odvod"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Nastavi omejitev vrste paketov na LEN paketov"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Ukazna vrstica v lupini za uporabo prilagoditvenega skripta, združljivega z "
 "vpnc"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "privzeto"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Prepusti promet programu 'script', ne pa TUN"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Nastavi prijavno uporabniško ime"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Pošli poročilo o različici"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Več podrobnosti odvoda"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 "Zapiši pretok podatkov overitve HTTP (omogoči podroben izpis z zastavico --"
 "verbose"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "Nastavitvena datoteka XML"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Izbor načina overitvene prijave"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Le overi in izpiši podrobnosti prijave"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Pridobi piškotek WEBVPN brez povezave"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Pred povezavo izpiši vsebino piškotka WEBVPN"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Datoteka potrdila za preverjanje istovetnosti strežnika"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Ne zahtevaj povezave IPv6"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Šifre OpenSSL za podporo DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Onemogoči DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Onemogoči ponovno uporabo povezave HTTP"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Onemogoči overitev gesla/SecurID"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Ne zahtevaj veljavnosti potrdila strežnika SSL"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Ne izvajaj overitev preko XML POST"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Ne pričakuj odziva uporabnika; prekini, če je obvezen"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Preberi geslo z navadnega vhoda"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Skrivnost programskega žetona"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 "(Opomba: knjižnica libstoken (RSA SecurID) je v tej izgradnji onemogočena)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Časovni zamik ponovnega vzpostavljanja povezave v sekundah"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Prstni odtis potrdila SHA1 strežnika"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Glava HTTP uporabniškega posrednika: polje"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Določite krajevna vrata za datagrame DTLS"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Pridobivanje vrstice iz nastavitvene datoteke je spodletelo: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Neprepoznana možnost v vrstici %d: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Možnost '%s' ne sprejme argumenta v vrstici %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Možnost '%s' zahteva argument v vrstici %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2368,49 +2405,49 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Strukture vpninfo ni mogoče dodeliti.\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Možnosti 'config' ni mogoče uporabiti znotraj nastavitvene datoteke\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Ni mogoče odpreti nastavitvene datoteke '%s': %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "Vrednost MTU %d je premajhna.\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2421,126 +2458,133 @@ msgstr ""
 "V kolikor možnost deluje, pošljite poročilo na <openconnect-devel@lists."
 "infradead.org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Ničelna dolžina uvrstitve ni dovoljena; uporabljena bo 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "Različica OpenConnect %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Neveljaven način programskega žetona \"%s\"\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Neveljavna istovetnost OS \"%s\"\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Navedenih je preveč argumentov v ukazni vrstici.\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Ni določenega strežnika\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Ta različica openconnect je zgrajena brez podpore libproxy\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Pridobivanje piškotka WebVPN je spodletelo\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Ustvarjanje povezave SSL je spodletelo.\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Nastavitev DTLS je spodletela; namesto tega bo uporabljen SSL\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Ni navedenega argumenta --script; Vrednosti DNS in nastavitve preusmerjanja "
 "niso nastavljene.\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Oglejte si http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Datoteke '%s' ni mogoče odpreti za pisanje: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Izvajanje programa je poslano v ozadje; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Datoteke %s ni mogoče odpreti za pisanje: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Zapisovanje nastavitev v %s je spodletelo: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Potrdilo SSL strežnika se ne ujema: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2551,89 +2595,100 @@ msgstr ""
 "Overjanje potrdila strežnika VPN \"%s\" je spodletelo.\n"
 "Vzrok: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr "Vnesite '%s' za sprejem, '%s' za prekinitev; vse drugo za pogled: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ne"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "da"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Izbira overitve \"%s\" ni na voljo.\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Zahtevano je uporabniško posredovanje v načinu brez posredovanja.\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Uporabniški prstni odtis je neveljaven\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Ni mogoče odpreti datoteke ~/.stokenrc.\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "Program OpenConnect ni izgrajen s podporo za libstoken\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Splošna napaka v knjižnici libstoken.\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "Program OpenConnect ni izgrajen s podporo za liboath\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Splošna napaka v knjižnici liboath.\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2648,16 +2703,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr "Nastavitev naprave je spodletela\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "V pričakovanju novih nalog; stanje nedejavnosti je %d ms ...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2725,7 +2780,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr "Poteka ustvarjanje kode žetona OATH TOTP.\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2857,505 +2912,624 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Začenjanje seje DTLSv1 je spodletela\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Začenjanje DTLSv1 CTX je spodletelo.\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Nastavljanje seznama šifer DTLS je spodletelo.\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Ni natanko ena šifra DTLS.\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"Predmet SSL_set_session() je spodletel s staro različico protokola 0x%x\n"
+"Ali je v uporabi različica programa OpenSSL, ki je starejša od različice "
+"0.9.8m?\n"
+"Za več podrobnosti si oglejte http://rt.openssl.org/Ticket/Display.html?"
+"id=1751\n"
+"Z uporabo zastavice --no-dtls v argumentu ukaza, se izognete temu sporočilu\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Različica OpenSSL je starejša kot tisti, s katero je bil program izgrajen, "
+"zato lahko DTLS spodleti!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Vzrok je najbrž v vašem okvarjenem OpenSSL.\n"
+"Oglejte si http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Izmenjava signalov DTLS je spodletela: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Pisanje v vtič SSL je spodletelo\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Branje iz vtiča SSL je spodletelo\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Napaka branja SSL %d (strežnik je najverjetneje zaprl povezavo); sledi "
 "ponovna povezava.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "Pisanje SSL je spodletelo: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "Geslo PEM je predolgo (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Dodatno potrdilo %s: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 "Razčlenjevanje Parse PKCS#12 je spodletelo (napaka je navedena zgoraj)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 ne vsebuje potrdil!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 ne vsebuje osebnega ključa!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Programnika TPM ni mogoče naložiti.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Začenjanje programnika TPM je spodletelo.\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Nastavljanje gesla TPM SRK je spodletelo\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Nalaganje zasebnega ključa TPM je spodletelo\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Dodajanje ključa iz TPM je spodletelo\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Odpiranje datoteke potrdila %s je spodletelo: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Nalaganje potrdila je spodletelo\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Ustvarjanje pravil BIO za predmet shrambe ključa '%s'\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Nalaganje zasebnega ključa je spodletelo (napačno šifrirno geslo?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Nalaganje zasebnega ključa je spodletelo (glejte napake zgoraj)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Nalaganje potrdila X509 iz shrambe ključev je spodletelo\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Uporaba potrdila X509 iz shrambe ključev je spodletela\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Uporaba zasebnega ključa iz shrambe ključev je spodletelo\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Odpiranje zasebne datoteke ključa %s je spodletelo: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Določevanje vrste zasebnega ključa v '%s' je spodletelo\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Ujemajoče altname DNS '%s'\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Ni zadetkov za altname '%s'\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 "Potrdilo ima določena drugotna imena GEN_IPADD z nedovoljeno dolžino %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Skladnih je %s naslovov '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Ni zadetkov za %s z naslovom '%s'\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "Naslov URI '%s' nima prazne poti; naslov bo prezrt.\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Ujemajoči naslov URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Ni zadetkov za naslov URI '%s'\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Nobeno izmed navedenih drugotnih imen v potrdilu ni skladno z '%s'\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Ni imena zadeve v potrdilu soležnika!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Razčlenjevanje imena zadeve v potrdilu soležnika je spodletelo.\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Neskladno potrdilo zadeve soležnika ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Skladno je ime zadeve v potrdilu soležnika '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Dodatno potrdilo iz datoteke potrdil: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Napaka v polju potrdila odjemalca notAfter\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<napaka>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Branje potrdil iz datoteke CA '%s' je spodletelo\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Odpiranje datoteke CA '%s' je spodletelo\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Povezava SSL je spodletela\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Opusti slabo deljenja z vključevanjem: \"%s\"\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Opusti slabo deljenje z izključevanjem: \"%s\"\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Oživljanje skripta '%s' za %s je spodletelo: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Skript '%s' je zaključen z napako (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Skript '%s' je vrnil napako %d\n"
@@ -3652,83 +3826,95 @@ msgstr "Napačno geslo PIN, poskusite znova.\n"
 msgid "Generating RSA token code\n"
 msgstr "Poteka ustvarjanje kode žetona RSA.\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/sq.po b/po/sq.po
index c1a61188..cce17b85 100644
--- a/po/sq.po
+++ b/po/sq.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Albanian (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/sr.po b/po/sr.po
index 8e0b5127..6badb3e6 100644
--- a/po/sr.po
+++ b/po/sr.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: F 677-CF0E\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-09-13 21:37+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-05-15 20:01+0200\n"
 "Last-Translator: Мирослав Николић <miroslavnikolic@rocketmail.com>\n"
 "Language-Team: Serbian <gnom@prevod.org>\n"
@@ -173,7 +173,7 @@ msgstr "Затражена ми је лозинка али је поставље
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Не преузимам ИксМЛ профил јер СХА1 већ одговара\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Нисам успео да отворим ХТТПС везу са „%s“\n"
@@ -312,429 +312,454 @@ msgstr "(Грешка приликом описивања грешке!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "ГРЕШКА: Не могу да покренем прикључнице\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "ТЦП_ИНФО прим пор %d, посл пор %d, пор огл %d, пмту %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "ТЦП_МАХСЕГ %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "КРИТИЧНА ГРЕШКА: Главна тајна ДТЛС-а није покренута. Известите о овоме.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Грешка стварања захтева за ХТТПС ПОВЕЗИВАЊЕ\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Грешка довлачења ХТТПС одговора\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "ВПН услуга није доступна; разлог: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Добих неодговарајући одговор ХТТП ПОВЕЗИВАЊА: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Добих одговор ПОВЕЗИВАЊА: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Нема меморије за опције\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "ИБ сесије Х-ДТЛС-а није 64 знака; већ: „%s“\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Непознато кодирање ДТЛС садржаја %s\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Непознато кодирање ЦСТП садржаја %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "МТУ није примљен. Прекидам\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Није примљена ИП адреса. Прекидам\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Примљено је ИПв6 подешавање али МТУ %d је премали.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Поновно повезивање је дало другачију Стару ИП адресу (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "Поновно повезивање је дало другачију Стару ИП мрежну маску (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Поновно повезивање је дало другачију ИПв6 адресу (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Поновно повезивање је дало другачију ИПв6 мрежну маску (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "ЦСТП је повезан. ДПД %d, Одржи живим %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "ЦСТП комплет шифрера: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Подешавање паковања није успело\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Додела међумеморије издувавања није успела\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "надувавање није успело\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Није успело ЛЗС распакивање: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Није успело ЛЗ4 распакивање\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Непозната врста паковања „%d“\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Примих %s запаковани пакет података од %d бајта (беше %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "издувавање није успело %d\n"
 
-#: cstp.c:860 dtls.c:239 dtls.c:684 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Није успела расподела\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Примљен је кратак пакет (%d бајта)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Неочекивана дужина пакета. ССЛ_читање је дало %d али пакет је\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Добих ЦСТП ДПД захтев\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Добих ЦСТП ДПД одговор\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Добих ЦСТП Одржи живим\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Примих пакет незапакованих података од %d бајта\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Примих прекид везе са сервера: %02x „%s“\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Примих прекид везе са сервера\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Сажети пакет је примљен у „!deflate“ режиму\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "примљен је серверов пакет окончавања\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Непознат пакет %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "ССЛ је записао премало бајтова! Тражио је %d, послао је %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Истек промене кључа ЦСТП-а\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Поновно руковање није успело; покушавам нови тунел\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "Откривање мртвог парњака ЦСТП-а је открило мртвог парњака!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Поновно повезивање није успело\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Послах ЦСТП ДПД\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Послах ЦСТП Одржи живим\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Шаљем пакет запакованих података од %d бајта (беше %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Шаљем пакет незапакованих података од %d бајта\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Послах пакет ОДЛСКА: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Покушавам сваривање потврђивања идентитета са посредником\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Покушавам прихватање потврђивања идентитета на серверу „%s“\n"
 
-#: dtls.c:75
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "ДТЛС веза је покушана са постојећим фд-ом\n"
 
-#: dtls.c:81
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Нема ДТЛС адресе\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:88
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Сервер је није понудио опцију ДТЛС шифрера\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:95
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Нема ДТЛС-а када сте повезани путем посредника\n"
 
-#: dtls.c:157
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Опција ДТЛС-а „%s“: %s\n"
 
-#: dtls.c:198
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "ДТЛС је покренут. ДПД %d, Одржи живим %d\n"
 
-#: dtls.c:224
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Покушај нову ДТЛС везу\n"
 
-#: dtls.c:250
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Примљен је ДТЛС пакет 0x%02x од %d бајта\n"
 
-#: dtls.c:264
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Добих ДТЛС ДПД захтев\n"
 
-#: dtls.c:270
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Нисам успео да пошаљем ДПД одговор. Очекујте прекид везе\n"
 
-#: dtls.c:274
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Добих ДТЛС ДПД одговор\n"
 
-#: dtls.c:278
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Добих ДТЛС Одржи живим\n"
 
-#: dtls.c:284
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Запаковани ДТЛС пакет је примљен када запакивање није укључено\n"
 
-#: dtls.c:292
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Непозната врста ДТЛС пакета %02x, дужина %d\n"
 
-#: dtls.c:314
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Истек промене кључа ДТЛС-а\n"
 
-#: dtls.c:321
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Није успело поновно ДТЛС руковање; пново се повезујем.\n"
 
-#: dtls.c:330
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "Откривање мртвог парњака ДТЛС-а је открило мртвог парњака!\n"
 
-#: dtls.c:336
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Послах ДТЛС ДПД\n"
 
-#: dtls.c:341
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Нисам успео да пошаљем ДПД захтев. Очекујте прекид везе\n"
 
-#: dtls.c:354
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Послах ДТЛС Одржи живим\n"
 
-#: dtls.c:359
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Нисам успео да пошаљем захтев одржи живим. Очекујте прекид везе\n"
 
-#: dtls.c:390 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Примљен је непознат пакет (дужине %d): %02x %02x %02x %02x...\n"
 
-#: dtls.c:397
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr "ТОС ово: %d, ТОС последње: %d\n"
 
-#: dtls.c:401
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr "Подешава опције прикључнице УДП"
 
-#: dtls.c:432
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "ДТЛС је добио грешку писања %d. Пребацујем се на ССЛ\n"
 
-#: dtls.c:446
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "ДТЛС је добио грешку писања: %s. Пребацујем се на ССЛ\n"
 
-#: dtls.c:461
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Послао сам ДТЛС пакет од %d бајта; ДТЛС-ово слање је дало %d\n"
 
-#: dtls.c:495
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Покрећем ИПв4 МТУ откривање (најм.=%d, најв.=%d)\n"
 
-#: dtls.c:501
+#: dtls.c:527
 msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:505
+#: dtls.c:531
 #, c-format
 msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:523 dtls.c:610
+#: dtls.c:540
 #, c-format
-msgid "Sending MTU DPD probe (%u bytes)\n"
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:527 dtls.c:614
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d)\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:537 dtls.c:634
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr "Примих неочекивани пакет (%.2x) у МТУ откривању; прескачем.\n"
 
-#: dtls.c:545 dtls.c:626
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
 msgid "Timeout while waiting for DPD response; resending probe.\n"
 msgstr ""
 
-#: dtls.c:552 dtls.c:653
+#: dtls.c:584 dtls.c:685
 #, c-format
 msgid "Failed to recv DPD request (%d)\n"
 msgstr ""
 
-#: dtls.c:557 dtls.c:639
+#: dtls.c:589
 #, c-format
-msgid "Received MTU DPD probe (%u bytes)\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:595
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Покрећем ИПв4 МТУ откривање\n"
 
-#: dtls.c:703
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "Отрио сам МТУ од %d бајта (беше %d)\n"
 
-#: dtls.c:706
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Нема промене у МТУ након откривања (беше %d)\n"
@@ -865,46 +890,94 @@ msgstr "Нисам успео да пошаљем ЕСП пакет: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Послах ЕСП пакет од %d бајта\n"
 
-#: gnutls-dtls.c:149
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
 #, c-format
 msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
 msgstr "Непознати ДТЛС параметри за затражени Комплет шифрера „%s“\n"
 
-#: gnutls-dtls.c:162
+#: gnutls-dtls.c:281
 #, c-format
 msgid "Failed to set DTLS priority: %s\n"
 msgstr "Нисам успео да поставим хитност ДТЛС-а: %s\n"
 
-#: gnutls-dtls.c:183
+#: gnutls-dtls.c:302
 #, c-format
 msgid "Failed to set DTLS session parameters: %s\n"
 msgstr "Нисам успео да поставим параметре ДТЛС сесије: %s\n"
 
-#: gnutls-dtls.c:206
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
 #, c-format
 msgid "Failed to set DTLS MTU: %s\n"
 msgstr "Нисам успео да поставим ДТЛС МТУ: %s\n"
 
-#: gnutls-dtls.c:224
+#: gnutls-dtls.c:382
 #, c-format
 msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
 msgstr "Успостављена је ДТЛС веза (користим ГнуТЛС). Комплет шифрера %s.\n"
 
-#: gnutls-dtls.c:230
+#: gnutls-dtls.c:388 openssl-dtls.c:522
 #, c-format
 msgid "DTLS connection compression using %s.\n"
 msgstr "Запакивање ДТЛС везе са „%s“.\n"
 
-#: gnutls-dtls.c:245
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
 msgid "DTLS handshake timed out\n"
 msgstr "Истекло је време ДТЛС руковања\n"
 
-#: gnutls-dtls.c:248
+#: gnutls-dtls.c:406
 #, c-format
 msgid "DTLS handshake failed: %s\n"
 msgstr "Није успело ДТЛС руковање: %s\n"
 
-#: gnutls-dtls.c:252
+#: gnutls-dtls.c:410
 msgid "(Is a firewall preventing you from sending UDP packets?)\n"
 msgstr "(Да ли вас мрежна баријера спречава да пошаљете УДП пакете?)\n"
 
@@ -947,7 +1020,7 @@ msgstr "Нисам успео да створим ЕСП пакет IV: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Нисам успео да шифрујем ЕСП пакет: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Отказано је ССЛ писање\n"
 
@@ -956,7 +1029,7 @@ msgstr "Отказано је ССЛ писање\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Нисам успео да пишем на ССЛ прикључницу: %s\n"
 
-#: gnutls.c:176 gnutls.c:268 openssl.c:191 openssl.c:258
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Отказано је ССЛ читање\n"
 
@@ -986,15 +1059,15 @@ msgstr "Није успело ССЛ слање: %s\n"
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Не могу да извучем време истека уверења\n"
 
-#: gnutls.c:351 openssl.c:1611
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Уверење клијента је истекло у"
 
-#: gnutls.c:353 openssl.c:1616
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Уверење клијента ускоро истиче"
 
-#: gnutls.c:402 openssl.c:786
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Нисам успео да учитам „%s“ из смештаја кључа: %s\n"
@@ -1023,11 +1096,11 @@ msgstr "Нисам успео да учитам уверење у мемориј
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Нисам успео да поставим структуру ПКЦС#12 података: %s\n"
 
-#: gnutls.c:493 openssl.c:555
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Нисам успео да дешифрујем датотеку ПКЦС#12 уверења\n"
 
-#: gnutls.c:497 openssl.c:558
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Унесите ПКЦС#12 лозинку:"
 
@@ -1101,7 +1174,7 @@ msgstr "Нисам успео да дешифрујем ПЕМ кључ: %s\n"
 msgid "Decrypting PEM key failed\n"
 msgstr "Није успело дешифровање ПЕМ кључа\n"
 
-#: gnutls.c:996 gnutls.c:1530 openssl.c:479
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Унесите ПЕМ лозинку:"
 
@@ -1133,7 +1206,7 @@ msgstr "Грешка учитавања уверења из ПКЦС#11: %s\n"
 msgid "Error loading system certificate: %s\n"
 msgstr "Грешка учитавања системског уверења: %s\n"
 
-#: gnutls.c:1159 openssl.c:842
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Користим датотеку уверења „%s“\n"
@@ -1196,7 +1269,7 @@ msgstr "Грешка увоза ПКЦС#11 кључа у структуру л
 msgid "Using private key file %s\n"
 msgstr "Користим датотеку личног кључа „%s“\n"
 
-#: gnutls.c:1451 openssl.c:666
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Ово издање Отвореног повезивања је изграђено без ТПМ подршке\n"
 
@@ -1214,7 +1287,7 @@ msgstr "Нисам успео да учитам ПКЦС#1 лични кључ:
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Нисам успео да учитам лични кључ као ПКЦС#8: %s\n"
 
-#: gnutls.c:1526 gnutls.c:1559 openssl.c:1013 openssl.c:1023
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Нисам успео да дешифрујем датотеку ПКЦС#8 уверења\n"
 
@@ -1223,7 +1296,7 @@ msgstr "Нисам успео да дешифрујем датотеку ПКЦ
 msgid "Failed to determine type of private key %s\n"
 msgstr "Нисам успео да одредим врсту личног кључа „%s“\n"
 
-#: gnutls.c:1563 openssl.c:1019
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Унесите ПКЦС#8 лозинку:"
 
@@ -1246,7 +1319,7 @@ msgstr "Грешка потврђивања потписа наспрам уве
 msgid "No SSL certificate found to match private key\n"
 msgstr "Нисам нашао ССЛ уверење које одговара личном кључу\n"
 
-#: gnutls.c:1675 openssl.c:581 openssl.c:724
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Користим уверење клијента „%s“\n"
@@ -1290,157 +1363,157 @@ msgstr "Додајем подржавајуће „%s“ издавача уве
 msgid "Setting certificate failed: %s\n"
 msgstr "Нисам успео да подесим уверење: %s\n"
 
-#: gnutls.c:2074
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Сервер није представио ниједно уверење\n"
 
-#: gnutls.c:2082
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr "Грешка упоређивања уверења сервера при поновном руковању: %s\n"
 
-#: gnutls.c:2087 openssl.c:1534
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "Сервер је представио другачије уверење при поновном руковању\n"
 
-#: gnutls.c:2092 openssl.c:1537
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "Сервер је представио исто уверење при поновном руковању\n"
 
-#: gnutls.c:2098
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Грешка покретања структуре X509 уверења\n"
 
-#: gnutls.c:2104
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Грешка увоза серверског уверења\n"
 
-#: gnutls.c:2113 main.c:1691
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Не могу да израчунам хеш серверског уверења\n"
 
-#: gnutls.c:2118
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Грешка провере стања уверења сервера\n"
 
-#: gnutls.c:2123
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "уверење је опозвано"
 
-#: gnutls.c:2125
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "потписник није пронађен"
 
-#: gnutls.c:2127
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "потписник није уверење издавача уверења"
 
-#: gnutls.c:2129
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "небезбедни алгоритам"
 
-#: gnutls.c:2131
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "уверење још није активирано"
 
-#: gnutls.c:2133
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "уверење је истекло"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2138
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "провера потписа није успела"
 
-#: gnutls.c:2187 openssl.c:1418 openssl.c:1570
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "уверење не одговара називу домаћина"
 
-#: gnutls.c:2192 openssl.c:1417 openssl.c:1576
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Није успела провера уверења сервера: %s\n"
 
-#: gnutls.c:2264
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Нисам успео да доделим меморију за уверења датотеке издавача уверења\n"
 
-#: gnutls.c:2285
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Нисам успео да прочитам уверења из датотеке издавача уверења: %s\n"
 
-#: gnutls.c:2301
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Нисам успео да отворим датотеку издавача уверења „%s“: %s\n"
 
-#: gnutls.c:2314 openssl.c:1698
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Нисам успео да учитам уверење. Прекидам.\n"
 
-#: gnutls.c:2385
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Нисам успео да поставим ниску хитности ТЛС-а (%s): %s\n"
 
-#: gnutls.c:2397 openssl.c:1815
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "ССЛ преговарање са „%s“\n"
 
-#: gnutls.c:2444 openssl.c:1841
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "ССЛ веза је отказана\n"
 
-#: gnutls.c:2451
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Неуспех ССЛ везе: %s\n"
 
-#: gnutls.c:2460
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Не-кобни резултат ГнуТЛС-а за време руковања: %s\n"
 
-#: gnutls.c:2466 openssl.c:1858
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Повезани сте на ХТТПС са „%s“\n"
 
-#: gnutls.c:2469
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Поново је договорен ССЛ на „%s“\n"
 
-#: gnutls.c:2652 openssl-pkcs11.c:199
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "Потребан је ПИН за %s“"
 
-#: gnutls.c:2656 openssl-pkcs11.c:202
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Погрешан ПИН"
 
-#: gnutls.c:2659
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Ово је последњи покушај пре закључавања!"
 
-#: gnutls.c:2661
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Остало је само неколико покушаја пре закључавања!"
 
-#: gnutls.c:2666 openssl-pkcs11.c:206
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Унесите ПИН:"
 
-#: gnutls.c:2797 openssl.c:1986
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Неподржани ОАТХ ХМАЦ алгоритам\n"
 
-#: gnutls.c:2806
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Нисам успео да израчунам ОАТХ ХМАЦ: %s\n"
@@ -1636,7 +1709,7 @@ msgstr "Покушавам ХТТП Основно потврђивање иде
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Покушавам ХТТП Основно потврђивање идентитета са сервером „%s“\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Ово издање Отвореног повезивања је изграђено без ГССАПИ подршке\n"
 
@@ -1658,239 +1731,239 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Нема више начина потврђивања идентитета\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Нема меморије за доделу колачића\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Нисам успео да обрадим ХТТП одговор „%s“\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Добих ХТТП одговор: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Грешка обраде ХТТП одговора\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Занемарујем непознати ред ХТТП одговора „%s“\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Понуђен је неисправан колачић: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Није успело потврђивање идентитета ССЛ уверења\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Тело одговора има негативну величину (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Непознато преносно-кодирање: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "ХТТП тело %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Грешка читања тела ХТТП одговора\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Грешка довлачења заглавља делића\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Грешка довлачења тела ХТТП одговора\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Грешка у искомаданом декодирању. Очекивах „“, добих: „%s“"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Не могу да примим ХТТП 1.0 тело без затварања везе\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Нисам успео да обрадим преусмерену адресу „%s“: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Не могу да пратим преусмерење на не-хттпс адресе „%s“\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Није успело додељивање нове путање за релативно преусмерење: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Неочекиван %d резултат са сервера\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "захтев је одобрен"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "општи неуспех"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "веза није дозвољена скупом правила"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "мрежа је недостижна"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "домаћин је недостижан"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "везу је одбио одредишни домаћин"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "ТТЛ је истекло"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "наредба није подржана / грешка протокола"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "врста адресе није подржана"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "СОЦКС сервер је затражио корисничко име/лозинку али ми немамо ниједно\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "Корисничко име и лозинка за СОЦКС потврђивање идентитета морају бити < 255 "
 "бајта\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Грешка писања захтева потврђивања идентитета на СОЦКС посреднику: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Грешка читања захтева потврђивања идентитета са СОЦКС посредника: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 "Неочекиван одговор потврђивања идентитета са СОЦКС посредника: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Потврдили сте идентитет на СОЦКС посреднику користећи лозинку\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Није успело потврђивање идентитета лозинком на СОЦКС серверу\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "СОЦКС сервер захтева ГССАПИ потврђивање идентитета\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "СОЦКС сервер захтева потврђивање идентитета лозинком\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "СОЦКС сервер захтева потврђивање идентитета\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "СОЦКС сервер захтева непознату врсту потврђивања идентитета %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Захтевам везу СОЦКС посредника са %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Грешка писања захтева повезивања са СОЦКС посредником: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Грешка читања одговора везе са СОЦКС посредника: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Неочекиван одговор везе са СОЦКС посредника: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Грешка СОЦКС посредника %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Грешка СОЦКС посредника %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Неочекивана врста адресе %02x у одговору СОЦКС везе\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Захтевам везу ХТТП посредника са %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Нисам успео да пошаљем захтев посредника: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Захтев ПОВЕЗИВАЊА посредника није успео: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Непозната врста посредника „%s“\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Подржани су само хттп или соцкс(5) посредници\n"
 
@@ -1903,16 +1976,28 @@ msgstr "Непознати ВПН протокол „%s“\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Изграђено је ССЛ библиотеком без Циско ДТЛС подршке\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Нисам успео да обрадим адресу сервера „%s“\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Дозвољено је само „https://“ за адресу сервера\n"
 
-#: library.c:1015
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Нема руковаоца обрасцем; не могу да потврдим идентитет.\n"
 
@@ -1928,20 +2013,25 @@ msgstr "Кобна грешка у раду са линијом наредби\n
 
 #: main.c:382
 #, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
+#, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "Није успела функција читања конзоле: %s\n"
 
-#: main.c:396 main.c:409
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Грешка претварања улаза конзоле: %s\n"
 
-#: main.c:403 main.c:635
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Неуспех додељвања за ниску са стандардног улаза\n"
 
-#: main.c:570
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1950,21 +2040,21 @@ msgstr ""
 "За испомоћ са Отвореним повезивањем, погледајте веб страницу на\n"
 "  „http://www.infradead.org/openconnect/mail.html“\n"
 
-#: main.c:579
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Користим ОпенССЛ. Присутне функције:"
 
-#: main.c:581
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Користим ГнуТЛС. Присутне функције:"
 
-#: main.c:590
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "Није присутан ПОГОН ОтвореногССЛ-а"
 
-#: main.c:622
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -1973,31 +2063,31 @@ msgstr ""
 "\n"
 "УПОЗОРЕЊЕ: Нема ДТЛС подршке у овој извршној. Делотворност ће бити умањена.\n"
 
-#: main.c:659
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (стдул)"
 
-#: main.c:699
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Не могу да обрадим путању ове извршне „%s“"
 
-#: main.c:705
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Додела за путању впнц-скрипте није успела\n"
 
-#: main.c:725
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Преписује назив домаћина „%s“ са „%s“\n"
 
-#: main.c:738
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Употреба:  openconnect [опције] <сервер>\n"
 
-#: main.c:739
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2006,307 +2096,307 @@ msgstr ""
 "Отворени клијент за Циско Ени Конект ВПН, издање %s\n"
 "\n"
 
-#: main.c:741
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Чита опције из датотеке подешавања"
 
-#: main.c:743
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Наставља у позадини након покретања"
 
-#: main.c:744
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Пише ПИБ позадинца у ову датотеку"
 
-#: main.c:746
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Користи уверење УВЕР ССЛ клијента"
 
-#: main.c:747
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Упозорава када је животни век уверења < ДАНА"
 
-#: main.c:748
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Користи КЉУЧ датотеке личног кључа ССЛ-а"
 
-#: main.c:749
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Користи колачић КОЛАЧИЋ ВебВПН-а"
 
-#: main.c:750
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Чита колачић са стандардног улаза"
 
-#: main.c:751
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Укључује сажимање (основно)"
 
-#: main.c:752
+#: main.c:766
 msgid "Disable compression"
 msgstr "Искључује сажимање"
 
-#: main.c:753
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Подешава најмањи период откривања неактивних парњака"
 
-#: main.c:754
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Подешава корисничку групу пријављивања"
 
-#: main.c:755
+#: main.c:769
 msgid "Display help text"
 msgstr "Приказује текст помоћи"
 
-#: main.c:756
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Користи АКОНАЗИВ за уређај тунела"
 
-#: main.c:758
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Користи системски дневник за поруке напредовања"
 
-#: main.c:760
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Додаје датум и време порукама напредовања"
 
-#: main.c:761
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr "Умножава ТОС / ТКЛАСУ када користи ДТЛС"
 
-#: main.c:763
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Одбацује овлашћења након повезивања"
 
-#: main.c:764
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Одбацује овлашћења за време извршавања ЦСД-а"
 
-#: main.c:765
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Покреће СКРИПТУ уместо ЦСД извршне"
 
-#: main.c:767
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr "Захтева МТУ са сервера (само стари сервери)"
 
-#: main.c:768
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Указује на МТУ путању до/од сервера"
 
-#: main.c:769
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Подешава лозинку кључа или ТПМ СРК ПИН"
 
-#: main.c:770
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Лозинка кључа је иб система датотека или систем датотека"
 
-#: main.c:771
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Подешава посреднички сервер"
 
-#: main.c:772
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Подешава начине потврђивања идентитета посредника"
 
-#: main.c:773
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Искључује посредника"
 
-#: main.c:774
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Користи „libproxy“ да самостално подеси посредника"
 
-#: main.c:776
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(НАПОМЕНА: „libproxy“ је искључена у овој изградњи)"
 
-#: main.c:778
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Захтева савршену тајност прослеђивања"
 
-#: main.c:779
+#: main.c:793
 msgid "Less output"
 msgstr "Мање излаза"
 
-#: main.c:780
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Подешава ограничење реда пакета на ДУЖИНУ пакета"
 
-#: main.c:781
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "Линија наредбе шкољке за коришћење впнц-сагласне скрипте подешавања"
 
-#: main.c:782
+#: main.c:796
 msgid "default"
 msgstr "основно"
 
-#: main.c:784
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Прослеђујем саобраћај програму „script“, а не туну"
 
-#: main.c:786
+#: main.c:800
 msgid "Set login username"
 msgstr "Подешава корисничко име пријављивања"
 
-#: main.c:787
+#: main.c:801
 msgid "Report version number"
 msgstr "Извештава о броју издања"
 
-#: main.c:788
+#: main.c:802
 msgid "More output"
 msgstr "Више излаза"
 
-#: main.c:789
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 "Исписује саобраћај ХТТП потврђивања идентитета (подразумева „--verbose“)"
 
-#: main.c:790
+#: main.c:804
 msgid "XML config file"
 msgstr "ИксМЛ датотека подешавања"
 
-#: main.c:791
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Бира избор пријаве потврђивања идентитета"
 
-#: main.c:792
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Само потврђује идентитет и исписује податке о пријави"
 
-#: main.c:793
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Само добавља вебвпн колачић; не повезује се"
 
-#: main.c:794
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Испсиује вебвпн колачић пре повезивања"
 
-#: main.c:795
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Датотека уверења за проверу сервера"
 
-#: main.c:796
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Не тражи ИПв6 повезивост"
 
-#: main.c:797
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Шифрери ОтвореногССЛ-а за подршку ДТЛС-а"
 
-#: main.c:798
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Искључује ДТЛС"
 
-#: main.c:799
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Искључује поновно коришћење ХТТП везе"
 
-#: main.c:800
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Искључује потврђивање идентитета лозинком/Безбедним ИБ-ом"
 
-#: main.c:801
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Не захтева да ССЛ уверење сервера буде исправно"
 
-#: main.c:802
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Искључује основне системске издаваче уверења"
 
-#: main.c:803
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Не покушава ИксМЛ ПОСТ потврђивање идентитета"
 
-#: main.c:804
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Не очекује кориснички унос; излази ако је затражен"
 
-#: main.c:805
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Чита лозинку са стандардног улаза"
 
-#: main.c:806
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Врста софтверског модула: „rsa“, „totp“ или „hotp“"
 
-#: main.c:807
+#: main.c:821
 msgid "Software token secret"
 msgstr "Тајна софтверског модула"
 
-#: main.c:809
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(НАПОМЕНА: „libstoken“ (РСА Безбедни ИБ) је искључена у овој изградњи)"
 
-#: main.c:812
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(НАПОМЕНА: „Yubikey“ ОАТХ је искључен у овој изградњи)"
 
-#: main.c:814
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Временски рок поновног повезивања у секундама"
 
-#: main.c:815
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "СХА1 отисак серверског уверења"
 
-#: main.c:816
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Корисник-Агент ХТТП заглавља: није успело"
 
-#: main.c:817
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Назив домаћина за обавештавање сервера"
 
-#: main.c:818
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Користи ИП приликом повезивања са ДОМАЋИНОМ"
 
-#: main.c:819
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Врста оперативног система (linux,linux-64,win,...) за извештавање"
 
-#: main.c:820
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Подешава месни прикључник за ДТЛС датаграме"
 
-#: main.c:841
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Нисам успео да доделим ниску\n"
 
-#: main.c:902
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Нисам успео да добавим ред из датотеке подешавања: %s\n"
 
-#: main.c:942
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Непозната опција у %d. реду: „%s“\n"
 
-#: main.c:952
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Опција „%s“ не узима аргумент у %d. реду\n"
 
-#: main.c:956
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Опција „%s“ захтева аргумент у %d. реду\n"
 
-#: main.c:981
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Неисправан корисник „%s“: %s\n"
 
-#: main.c:991
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "Неисправан ИБ корисника „%d“: %s\n"
 
-#: main.c:1043
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2317,7 +2407,7 @@ msgstr ""
 "         подршке али изгледа да користите наслеђени знак\n"
 "         подесите „%s“. Очекујте неочекивано.\n"
 
-#: main.c:1050
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2326,42 +2416,42 @@ msgstr ""
 "УПОЗОРЕЊЕ: Ово издање „openconnect“-а је %s али\n"
 "         библиотека „libopenconnect“ је %s\n"
 
-#: main.c:1060
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Нисам успео да доделим структуру впнподатака\n"
 
-#: main.c:1115
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Не можете користити опцију „config“ унутар датотеке подешавања\n"
 
-#: main.c:1123
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Не могу да отворим датотеку подешавања „%s“: %s\n"
 
-#: main.c:1139
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Неисправан режим запакивања „%s“\n"
 
-#: main.c:1160
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Недостаје двотачка у опцији решавања\n"
 
-#: main.c:1165
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Нисам успео да доделим меморију\n"
 
-#: main.c:1245 main.c:1254
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "МТУ %d је премало\n"
 
-#: main.c:1284
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2372,7 +2462,7 @@ msgstr ""
 "Ако ово помогне, известите о томе на „<openconnect-devel@lists.infradead."
 "org>“.\n"
 
-#: main.c:1290
+#: main.c:1304
 #, c-format
 msgid ""
 "The --no-cert-check option was insecure and has been removed.\n"
@@ -2381,126 +2471,126 @@ msgstr ""
 "Опција „--no-cert-check“ није била безбедна и уклоњена је.\n"
 "Исправите ваше уверење сервера или користите „--servercert“ да му верујете.\n"
 
-#: main.c:1307
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Нулта дужина реда није дозвољена; користим 1\n"
 
-#: main.c:1321
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "Отворено повезивање издање %s\n"
 
-#: main.c:1354
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Неисправан режим софтверског модула „%s“\n"
 
-#: main.c:1364
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Неисправан одредник ОС-а „%s“\n"
 
-#: main.c:1397
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Превише аргумената на линији наредби\n"
 
-#: main.c:1400
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Није наведен сервер\n"
 
-#: main.c:1416
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 "Ово издање отвореног повезивања је изграђено без подршке библиотеке "
 "посредника\n"
 
-#: main.c:1445
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Грешка отварања спојке наредбе\n"
 
-#: main.c:1478
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Нисам успео да добијем ВебВПН колачић\n"
 
-#: main.c:1499
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Није успело стварање ССЛ везе\n"
 
-#: main.c:1511
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Није успело подешавање ДТЛС-а; користим ССЛ\n"
 
-#: main.c:1531
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Повезан сам као %s%s%s, користим „%s%s“\n"
 
-#: main.c:1540
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr "Није достављен аргумент „--script“; ДНС и упућивање нису подешени\n"
 
-#: main.c:1542
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Погледајте „http://www.infradead.org/openconnect/vpnc-script.html“\n"
 
-#: main.c:1555
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Нисам успео да отворим „%s“ ради уписа: %s\n"
 
-#: main.c:1567
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Настављам рад у позадини, пиб %d\n"
 
-#: main.c:1584
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Корисник је затражио поновно повезивање\n"
 
-#: main.c:1592
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Колачић је одбачен при поновном повезивању; излазим.\n"
 
-#: main.c:1596
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Сервер је окончао сесију; излазим.\n"
 
-#: main.c:1600
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Корисник је отказао (SIGINT); излазим.\n"
 
-#: main.c:1604
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Корисник се откачио са сесије (SIGHUP); излазим.\n"
 
-#: main.c:1608
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Непозната грешка; излазим.\n"
 
-#: main.c:1627
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Нисам успео да отворим „%s“ ради уписа: %s\n"
 
-#: main.c:1635
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Нисам успео да упишем подешавања у „%s“: %s\n"
 
-#: main.c:1694
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Серверско ССЛ уверење не одговара: %s\n"
 
-#: main.c:1713
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2511,101 +2601,101 @@ msgstr ""
 "Није успело потврђивање уверења са ВПН сервера „%s“.\n"
 "Разлог: %s\n"
 
-#: main.c:1716
+#: main.c:1730
 #, c-format
 msgid ""
 "To trust this server in future, perhaps add this to your command line:\n"
 msgstr "Да и даље верујете овом серверу, додајте ово на линију наредби:\n"
 
-#: main.c:1717
+#: main.c:1731
 #, c-format
 msgid "    --servercert %s\n"
 msgstr "    --servercert %s\n"
 
-#: main.c:1722
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Унесите „%s“ да прихватите, „%s“ да прекинете; било шта друго да прегледате: "
 
-#: main.c:1723 main.c:1741
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "не"
 
-#: main.c:1723 main.c:1729
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "да"
 
-#: main.c:1750
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Хеш серверског кључа: %s\n"
 
-#: main.c:1784
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Избор потврђивања идентитета „%s“ се поклапа са више опција\n"
 
-#: main.c:1787
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Избор потврђивања „%s“ није доступан\n"
 
-#: main.c:1808
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Кориснички улаз је затражен у немеђудејственом режиму\n"
 
-#: main.c:1985
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Нисам успео да отворим датотеку модула ради уписа: %s\n"
 
-#: main.c:1993
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Нисам успео да запишем модул: %s\n"
 
-#: main.c:2039 main.c:2060
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Ниска софтверског модула је неисправна\n"
 
-#: main.c:2042
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Не могу да отворим датотеку „~/.stokenrc“\n"
 
-#: main.c:2045
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "Отворено повезивање није изграђено са подршком „libstoken“-а\n"
 
-#: main.c:2048
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Општи неуспех у „libstoken“-у\n"
 
-#: main.c:2063
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "Отворено повезивање није изграђено са подршком „liboath“-а\n"
 
-#: main.c:2066
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Општи неуспех у „liboath“-у\n"
 
-#: main.c:2077
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Нисам нашао модул Јуби кључа\n"
 
-#: main.c:2080
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "Отворено повезивање није изграђено са подршком Јуби кључа\n"
 
-#: main.c:2083
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Општи неуспех Јуби кључа: %s\n"
@@ -2620,16 +2710,16 @@ msgstr "Подешавање тун скрипте није успело\n"
 msgid "Set up tun device failed\n"
 msgstr "Подешавање тун уређаја није успело\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Позивник је паузирао везу\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Беспослен сам; одспаваћу %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "Чекање на више објеката није успело: %s\n"
@@ -2697,7 +2787,7 @@ msgstr "Сервер одбија софтверски модул; прелаз
 msgid "Generating OATH TOTP token code\n"
 msgstr "Стварам код ОАТХ ТОТП модула\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Стварам код ОАТХ ХОТП модула\n"
 
@@ -2829,138 +2919,222 @@ msgstr "Добих КМП поруку %d величине %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Примих не-ЕСП ТЛВ-а (група %d) у ЕСП преговора КМП\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Грешка стварања захтева оНЦП преговарања\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Кратко писање у оНЦП преговарању\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Читам %d бајта ССЛ записа\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Неочекивани одговор величине %d након пакета назива домаћина\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Одговор сервера пакету назива домаћина је грешка 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Неисправан пакет чека на КМП 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Очекивах КМП поруку 301 са сервера али добих %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "КМП порука 301 са сервера је превелика (%d бајта)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Добих КМП поруку 301 величине %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Нисам успео да прочитам дужину записа наставка\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "Запис додатна %d бајта је превелик; направићу %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Нисам успео да прочитам запис наставка дужине %d\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Читам додатна %d бајта КМП 301 поруке\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Грешка преговарања ЕСП кључа\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "ново долазно"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "ново одлазно"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "Занемарујем ЕСП кључеве пошто ЕСП подршка није доступна у овом издању\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Читам само 1 бајт оНЦП дужине поља\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "Сервер је окончао везу (сесија је истекла)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "Сервер је окончао везу (разлог: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "Сервер је послао оНЦП запис нулте дужине\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "Долазна КМП порука %d величине %d (добих %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr "Настављам да обрађујем КМП поруку %d сада величине %d (добих %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Непознати пакет података\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Непозната КМП порука %d величине %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d бајтова непримљених\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Одлазни пакет:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Послах контролни пакет ЕСП укључивања\n"
 
-#: openconnect-internal.h:1054 openconnect-internal.h:1062
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "ГРЕШКА: „%s()“ је позвано са неисправним УТФ-8 за аргумент „%s“\n"
 
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Нисам успео да направим „SSL_SESSION ASN.1“ за ОпенССЛ: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "Опен ССЛ није успео да обради „SSL_SESSION ASN.1“\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Није успело покретање ДТЛСв1 сесије\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Није успело покретање ДТЛСв1 ЦТХ-а\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr "Подешавање ДТЛС ЦТИкс издања није успело\n"
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Није успело постављање списка ДТЛС шифрера\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Није баш један ДТЛС шифрер\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"Функција „SSL_set_session()“ није успела са старим издањем протокола 0x%x\n"
+"Да ли користите издање ОпенССЛ-а старије од 0.9.8m?\n"
+"Видите “http://rt.openssl.org/Ticket/Display.html?id=1751“\n"
+"Користите опцију „--no-dtls“ да избегнете ову поруку\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+"Успостављена је ДТЛС веза (користим Отворени ССЛ). Комплет шифрера %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Ваш Отворени ССЛ је старији од оног који сте изградили с њим, тако да ДТЛС "
+"можда неће успети!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Вероватно зато што је оштећен ваш Отворени ССЛ\n"
+"Видите „http://rt.openssl.org/Ticket/Display.html?id=2984“\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Није успело ДТЛС руковање: %d\n"
+
 #: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Нисам успео да покренем ЕСП шифрера:\n"
@@ -3056,7 +3230,7 @@ msgstr "Нисам успео да нађем ПКЦС#11 уверење „%s
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "либп11 није довукла садржај Х.509 уверења\n"
 
-#: openssl-pkcs11.c:412 openssl.c:728
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Нисам успео да инсталирам уверење у ОпенССЛ контекст\n"
 
@@ -3107,260 +3281,260 @@ msgstr "Додавање кључа из ПКЦС#11 није успело\n"
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Ово издање Отвореног повезивања је изграђено без ПКЦС#11 подршке\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Нисам успео да пишем на ССЛ прикључницу\n"
 
-#: openssl.c:184 openssl.c:250
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Нисам успео да читам са ССЛ прикључнице\n"
 
-#: openssl.c:279
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Грешка ССЛ читања %d (сервер је вероватно затворио везу); поново се "
 "повезујем.\n"
 
-#: openssl.c:304
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "Није успело ССЛ_писање: %d\n"
 
-#: openssl.c:378
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Непозната врста захтева КС ССЛ-а %d\n"
 
-#: openssl.c:486
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "ПЕМ лозинка је предуга (%d >= %d)\n"
 
-#: openssl.c:519
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Додатно уверење из „%s“: %s\n"
 
-#: openssl.c:569
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Није успела обрада ПКЦС#12 (видите грешке изнад)\n"
 
-#: openssl.c:584
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "ПКЦС#12 не садржи уверење!\n"
 
-#: openssl.c:593
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "ПКЦС#12 не садржи лични кључ!\n"
 
-#: openssl.c:598
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "ПКЦС#12"
 
-#: openssl.c:616
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Не могу да учитам ТПМ погон.\n"
 
-#: openssl.c:622
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Нисам успео да покренем ТПМ погон\n"
 
-#: openssl.c:632
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Нисам успео да подесим ТПМ СРК лозинку\n"
 
-#: openssl.c:646
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Нисам успео да учитам ТПМ лични кључ\n"
 
-#: openssl.c:652
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Додавање кључа из ТПМ-а није успело\n"
 
-#: openssl.c:702 openssl.c:850
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Нисам успео да отворим датотеку уверења „%s“: %s\n"
 
-#: openssl.c:712
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Нисам успео да учитам уверење\n"
 
-#: openssl.c:750
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr "Нисам успео да обрадим сва подржавајућа уверења. Ипак покушавам...\n"
 
-#: openssl.c:763
+#: openssl.c:776
 msgid "PEM file"
 msgstr "ПЕМ датотека"
 
-#: openssl.c:792
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Нисам успео да направим БИО за ставку смештаја кључева „%s“\n"
 
-#: openssl.c:817
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Учитавање личног кључа није успело (погрешна лозинка?)\n"
 
-#: openssl.c:823
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Учитавање личног кључа није успело (видите грешке изнад)\n"
 
-#: openssl.c:873
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Нисам успео да учитам Х509 уверење из смештаја кључа\n"
 
-#: openssl.c:879
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Нисам успео да користим Х509 уверење из смештаја кључа\n"
 
-#: openssl.c:911
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Нисам успео да користим лични кључ из смештаја кључа\n"
 
-#: openssl.c:927
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Нисам успео да отворим датотеку личног кључа „%s“: %s\n"
 
-#: openssl.c:947 openssl.c:962 openssl.c:983 openssl.c:1049
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Учитавање личног кључа није успело\n"
 
-#: openssl.c:1043
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr "Нисам успео да претворим ПКЦС#8 у ОпенССЛ ЕВП_ПКЉУЧ\n"
 
-#: openssl.c:1060
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Нисам успео да одредим врсту личног кључа у „%s“\n"
 
-#: openssl.c:1222
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Поклопих ДНС заменски назив „%s“\n"
 
-#: openssl.c:1229
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Нема поклапања за заменски назив „%s“\n"
 
-#: openssl.c:1243
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Уверење има заменски назив „GEN_IPADD“ са привидном дужином %d\n"
 
-#: openssl.c:1254 openssl.c:1400
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Поклопљена је %s адреса „%s“\n"
 
-#: openssl.c:1261
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Нема поклапања за %s адресу „%s“\n"
 
-#: openssl.c:1303
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "Путања „%s“ има не-празну путању; занемарујем\n"
 
-#: openssl.c:1308
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Одговарајућа путања „%s“\n"
 
-#: openssl.c:1319
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Нема поклапања за путању „%s“\n"
 
-#: openssl.c:1334
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Нема одговарајућег заменског назива у уверењу парњака „%s“\n"
 
-#: openssl.c:1342
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Нема назива теме у уверењу парњака!\n"
 
-#: openssl.c:1362
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Нисам успео да обрадим назив теме у уверењу парњака\n"
 
-#: openssl.c:1369
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Тема уверења парњака не одговара ('%s' != '%s')\n"
 
-#: openssl.c:1374 openssl.c:1408
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Одговарајући назив теме уверења парњака „%s“\n"
 
-#: openssl.c:1470
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Додатно уверење из датотеке издавача уверења: %s\n"
 
-#: openssl.c:1608
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Грешка у пољу није_након у уверењу клијента\n"
 
-#: openssl.c:1621
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<грешка>"
 
-#: openssl.c:1674
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr "Стварање ТЛСв1 ЦТИкс-а није успело\n"
 
-#: openssl.c:1693
+#: openssl.c:1705
 msgid "SSL certificate and key do not match\n"
 msgstr "ССЛ уверење и кључ се не подударају\n"
 
-#: openssl.c:1738
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Нисам успео да прочитам уверења из датотеке издавача уверења „%s“\n"
 
-#: openssl.c:1771
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Нисам успео да отворим датотеку издавача уверења „%s“\n"
 
-#: openssl.c:1831
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Неуспех ССЛ везе\n"
 
-#: openssl.c:1992
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Нисам успео да израчунам ОАТХ ХМАЦ\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Одбацујем укључивања лоше поделе: „%s“\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Одбацујем искључивања лоше поделе: „%s“\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Нисам успео да изродим скрипту „%s“ за %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Скрипта „%s“ је изашла неисправно (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Скрипта „%s“ је дала грешку %d\n"
@@ -3662,87 +3836,99 @@ msgstr "Неисправан запис ПИН-а; покушајте понов
 msgid "Generating RSA token code\n"
 msgstr "Стварам код РСА модула\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Грешка приступа кључу регистра за мрежним прилагођивачима\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Занемарујем не-подударајући ТАП уређај „%s“\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 "Нисам нашао Виндоуз-ТАП прилагођиваче. Да ли је инсталиран управљачки "
 "програм?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Нисам успео да отворим „%s“\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Отворио сам тун уређај „%s“\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Нисам успео да добијем издање ТАП управљачког програма: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Грешка: Потребан је управљачки програм ТАП-Виндоуза v9.9 или већи (нађох %ld."
 "%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Нисам успео да подесим ТАП ИП адресе: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Нисам успео да подесим стање ТАП медија: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "ТАП уређај је прекинуо повезивост. Прекидам везу.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Нисам успео да читам са ТАП уређаја: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Нисам успео да довршим читање са ТАП уређаја: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Записах %ld бајта на туну\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Чекам на записивање туна...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Записах %ld бајта на туну након чекања\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Нисам успео да пишем на ТАП уређај: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Израђање тунелских скрипти још није подржано на Виндоузу\n"
 
@@ -4047,71 +4233,3 @@ msgstr "наредба израчунавања"
 #: yubikey.c:608
 msgid "Unrecognised response from Yubikey when generating tokencode\n"
 msgstr "Непознат одговор са Јуби кључа приликом стварања кода модула\n"
-
-#~ msgid "using OpenSSL"
-#~ msgstr "користим ОтворениССЛ"
-
-#~ msgid "Failed to recv DPD request (%d): %s\n"
-#~ msgstr "Нисам успео да примим ДПД захтев (%d): %s\n"
-
-#~ msgid "Failed to send DPD request (%d): %s\n"
-#~ msgstr "Нисам успео да пошаљем ДПД захтев (%d): %s\n"
-
-#~ msgid "Too long time in MTU detect loop; bailing out.\n"
-#~ msgstr "Предуго време у петљи МТУ откривања; извлачим се.\n"
-
-#~ msgid "SSL operation cancelled\n"
-#~ msgstr "ССЛ радња је отказана\n"
-
-#~ msgid "DTLS handshake failed: %d\n"
-#~ msgstr "Није успело ДТЛС руковање: %d\n"
-
-#~ msgid ""
-#~ "This is probably because your OpenSSL is broken\n"
-#~ "See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-#~ msgstr ""
-#~ "Вероватно зато што је оштећен ваш Отворени ССЛ\n"
-#~ "Видите „http://rt.openssl.org/Ticket/Display.html?id=2984“\n"
-
-#~ msgid ""
-#~ "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-#~ msgstr ""
-#~ "Ваш Отворени ССЛ је старији од оног који сте изградили с њим, тако да "
-#~ "ДТЛС можда неће успети!"
-
-#~ msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-#~ msgstr ""
-#~ "Успостављена је ДТЛС веза (користим Отворени ССЛ). Комплет шифрера %s.\n"
-
-#~ msgid ""
-#~ "SSL_set_session() failed with old protocol version 0x%x\n"
-#~ "Are you using a version of OpenSSL older than 0.9.8m?\n"
-#~ "See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-#~ "Use the --no-dtls command line option to avoid this message\n"
-#~ msgstr ""
-#~ "Функција „SSL_set_session()“ није успела са старим издањем протокола 0x"
-#~ "%x\n"
-#~ "Да ли користите издање ОпенССЛ-а старије од 0.9.8m?\n"
-#~ "Видите “http://rt.openssl.org/Ticket/Display.html?id=1751“\n"
-#~ "Користите опцију „--no-dtls“ да избегнете ову поруку\n"
-
-#~ msgid "Not precisely one DTLS cipher\n"
-#~ msgstr "Није баш један ДТЛС шифрер\n"
-
-#~ msgid "Set DTLS cipher list failed\n"
-#~ msgstr "Није успело постављање списка ДТЛС шифрера\n"
-
-#~ msgid "Set DTLS CTX version failed\n"
-#~ msgstr "Подешавање ДТЛС ЦТИкс издања није успело\n"
-
-#~ msgid "Initialise DTLSv1 CTX failed\n"
-#~ msgstr "Није успело покретање ДТЛСв1 ЦТХ-а\n"
-
-#~ msgid "Initialise DTLSv1 session failed\n"
-#~ msgstr "Није успело покретање ДТЛСв1 сесије\n"
-
-#~ msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-#~ msgstr "Опен ССЛ није успео да обради „SSL_SESSION ASN.1“\n"
-
-#~ msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-#~ msgstr "Нисам успео да направим „SSL_SESSION ASN.1“ за ОпенССЛ: %s\n"
diff --git a/po/sr@latin.po b/po/sr@latin.po
index 978d3363..39a51658 100644
--- a/po/sr@latin.po
+++ b/po/sr@latin.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: F 677-CF0E\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-09-13 21:37+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-05-15 20:01+0200\n"
 "Last-Translator: Miroslav Nikolić <miroslavnikolic@rocketmail.com>\n"
 "Language-Team: Serbian <gnom@prevod.org>\n"
@@ -173,7 +173,7 @@ msgstr "Zatražena mi je lozinka ali je postavljeno „--no-passwd“\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Ne preuzimam IksML profil jer SHA1 već odgovara\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Nisam uspeo da otvorim HTTPS vezu sa „%s“\n"
@@ -312,429 +312,454 @@ msgstr "(Greška prilikom opisivanja greške!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "GREŠKA: Ne mogu da pokrenem priključnice\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO prim por %d, posl por %d, por ogl %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAHSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 "KRITIČNA GREŠKA: Glavna tajna DTLS-a nije pokrenuta. Izvestite o ovome.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Greška stvaranja zahteva za HTTPS POVEZIVANJE\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Greška dovlačenja HTTPS odgovora\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN usluga nije dostupna; razlog: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Dobih neodgovarajući odgovor HTTP POVEZIVANJA: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Dobih odgovor POVEZIVANJA: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Nema memorije za opcije\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "IB sesije H-DTLS-a nije 64 znaka; već: „%s“\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Nepoznato kodiranje DTLS sadržaja %s\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Nepoznato kodiranje CSTP sadržaja %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "MTU nije primljen. Prekidam\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Nije primljena IP adresa. Prekidam\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "Primljeno je IPv6 podešavanje ali MTU %d je premali.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Ponovno povezivanje je dalo drugačiju Staru IP adresu (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 "Ponovno povezivanje je dalo drugačiju Staru IP mrežnu masku (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Ponovno povezivanje je dalo drugačiju IPv6 adresu (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Ponovno povezivanje je dalo drugačiju IPv6 mrežnu masku (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP je povezan. DPD %d, Održi živim %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP komplet šifrera: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Podešavanje pakovanja nije uspelo\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Dodela međumemorije izduvavanja nije uspela\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "naduvavanje nije uspelo\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "Nije uspelo LZS raspakivanje: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "Nije uspelo LZ4 raspakivanje\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Nepoznata vrsta pakovanja „%d“\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Primih %s zapakovani paket podataka od %d bajta (beše %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "izduvavanje nije uspelo %d\n"
 
-#: cstp.c:860 dtls.c:239 dtls.c:684 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Nije uspela raspodela\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Primljen je kratak paket (%d bajta)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Neočekivana dužina paketa. SSL_čitanje je dalo %d ali paket je\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Dobih CSTP DPD zahtev\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Dobih CSTP DPD odgovor\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Dobih CSTP Održi živim\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Primih paket nezapakovanih podataka od %d bajta\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Primih prekid veze sa servera: %02x „%s“\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Primih prekid veze sa servera\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Sažeti paket je primljen u „!deflate“ režimu\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "primljen je serverov paket okončavanja\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Nepoznat paket %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL je zapisao premalo bajtova! Tražio je %d, poslao je %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "Istek promene ključa CSTP-a\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Ponovno rukovanje nije uspelo; pokušavam novi tunel\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "Otkrivanje mrtvog parnjaka CSTP-a je otkrilo mrtvog parnjaka!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Ponovno povezivanje nije uspelo\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Poslah CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Poslah CSTP Održi živim\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Šaljem paket zapakovanih podataka od %d bajta (beše %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Šaljem paket nezapakovanih podataka od %d bajta\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Poslah paket ODLSKA: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Pokušavam svarivanje potvrđivanja identiteta sa posrednikom\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Pokušavam prihvatanje potvrđivanja identiteta na serveru „%s“\n"
 
-#: dtls.c:75
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "DTLS veza je pokušana sa postojećim fd-om\n"
 
-#: dtls.c:81
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Nema DTLS adrese\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:88
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Server je nije ponudio opciju DTLS šifrera\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:95
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Nema DTLS-a kada ste povezani putem posrednika\n"
 
-#: dtls.c:157
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "Opcija DTLS-a „%s“: %s\n"
 
-#: dtls.c:198
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS je pokrenut. DPD %d, Održi živim %d\n"
 
-#: dtls.c:224
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Pokušaj novu DTLS vezu\n"
 
-#: dtls.c:250
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Primljen je DTLS paket 0x%02x od %d bajta\n"
 
-#: dtls.c:264
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Dobih DTLS DPD zahtev\n"
 
-#: dtls.c:270
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Nisam uspeo da pošaljem DPD odgovor. Očekujte prekid veze\n"
 
-#: dtls.c:274
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Dobih DTLS DPD odgovor\n"
 
-#: dtls.c:278
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Dobih DTLS Održi živim\n"
 
-#: dtls.c:284
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Zapakovani DTLS paket je primljen kada zapakivanje nije uključeno\n"
 
-#: dtls.c:292
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Nepoznata vrsta DTLS paketa %02x, dužina %d\n"
 
-#: dtls.c:314
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "Istek promene ključa DTLS-a\n"
 
-#: dtls.c:321
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "Nije uspelo ponovno DTLS rukovanje; pnovo se povezujem.\n"
 
-#: dtls.c:330
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "Otkrivanje mrtvog parnjaka DTLS-a je otkrilo mrtvog parnjaka!\n"
 
-#: dtls.c:336
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Poslah DTLS DPD\n"
 
-#: dtls.c:341
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Nisam uspeo da pošaljem DPD zahtev. Očekujte prekid veze\n"
 
-#: dtls.c:354
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Poslah DTLS Održi živim\n"
 
-#: dtls.c:359
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Nisam uspeo da pošaljem zahtev održi živim. Očekujte prekid veze\n"
 
-#: dtls.c:390 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Primljen je nepoznat paket (dužine %d): %02x %02x %02x %02x...\n"
 
-#: dtls.c:397
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr "TOS ovo: %d, TOS poslednje: %d\n"
 
-#: dtls.c:401
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr "Podešava opcije priključnice UDP"
 
-#: dtls.c:432
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS je dobio grešku pisanja %d. Prebacujem se na SSL\n"
 
-#: dtls.c:446
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS je dobio grešku pisanja: %s. Prebacujem se na SSL\n"
 
-#: dtls.c:461
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Poslao sam DTLS paket od %d bajta; DTLS-ovo slanje je dalo %d\n"
 
-#: dtls.c:495
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Pokrećem IPv4 MTU otkrivanje (najm.=%d, najv.=%d)\n"
 
-#: dtls.c:501
+#: dtls.c:527
 msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:505
+#: dtls.c:531
 #, c-format
 msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:523 dtls.c:610
+#: dtls.c:540
 #, c-format
-msgid "Sending MTU DPD probe (%u bytes)\n"
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:527 dtls.c:614
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d)\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:537 dtls.c:634
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr "Primih neočekivani paket (%.2x) u MTU otkrivanju; preskačem.\n"
 
-#: dtls.c:545 dtls.c:626
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
 msgid "Timeout while waiting for DPD response; resending probe.\n"
 msgstr ""
 
-#: dtls.c:552 dtls.c:653
+#: dtls.c:584 dtls.c:685
 #, c-format
 msgid "Failed to recv DPD request (%d)\n"
 msgstr ""
 
-#: dtls.c:557 dtls.c:639
+#: dtls.c:589
 #, c-format
-msgid "Received MTU DPD probe (%u bytes)\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:595
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Pokrećem IPv4 MTU otkrivanje\n"
 
-#: dtls.c:703
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "Otrio sam MTU od %d bajta (beše %d)\n"
 
-#: dtls.c:706
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Nema promene u MTU nakon otkrivanja (beše %d)\n"
@@ -865,46 +890,94 @@ msgstr "Nisam uspeo da pošaljem ESP paket: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Poslah ESP paket od %d bajta\n"
 
-#: gnutls-dtls.c:149
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
 #, c-format
 msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
 msgstr "Nepoznati DTLS parametri za zatraženi Komplet šifrera „%s“\n"
 
-#: gnutls-dtls.c:162
+#: gnutls-dtls.c:281
 #, c-format
 msgid "Failed to set DTLS priority: %s\n"
 msgstr "Nisam uspeo da postavim hitnost DTLS-a: %s\n"
 
-#: gnutls-dtls.c:183
+#: gnutls-dtls.c:302
 #, c-format
 msgid "Failed to set DTLS session parameters: %s\n"
 msgstr "Nisam uspeo da postavim parametre DTLS sesije: %s\n"
 
-#: gnutls-dtls.c:206
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
 #, c-format
 msgid "Failed to set DTLS MTU: %s\n"
 msgstr "Nisam uspeo da postavim DTLS MTU: %s\n"
 
-#: gnutls-dtls.c:224
+#: gnutls-dtls.c:382
 #, c-format
 msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
 msgstr "Uspostavljena je DTLS veza (koristim GnuTLS). Komplet šifrera %s.\n"
 
-#: gnutls-dtls.c:230
+#: gnutls-dtls.c:388 openssl-dtls.c:522
 #, c-format
 msgid "DTLS connection compression using %s.\n"
 msgstr "Zapakivanje DTLS veze sa „%s“.\n"
 
-#: gnutls-dtls.c:245
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
 msgid "DTLS handshake timed out\n"
 msgstr "Isteklo je vreme DTLS rukovanja\n"
 
-#: gnutls-dtls.c:248
+#: gnutls-dtls.c:406
 #, c-format
 msgid "DTLS handshake failed: %s\n"
 msgstr "Nije uspelo DTLS rukovanje: %s\n"
 
-#: gnutls-dtls.c:252
+#: gnutls-dtls.c:410
 msgid "(Is a firewall preventing you from sending UDP packets?)\n"
 msgstr "(Da li vas mrežna barijera sprečava da pošaljete UDP pakete?)\n"
 
@@ -947,7 +1020,7 @@ msgstr "Nisam uspeo da stvorim ESP paket IV: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Nisam uspeo da šifrujem ESP paket: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "Otkazano je SSL pisanje\n"
 
@@ -956,7 +1029,7 @@ msgstr "Otkazano je SSL pisanje\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Nisam uspeo da pišem na SSL priključnicu: %s\n"
 
-#: gnutls.c:176 gnutls.c:268 openssl.c:191 openssl.c:258
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "Otkazano je SSL čitanje\n"
 
@@ -986,15 +1059,15 @@ msgstr "Nije uspelo SSL slanje: %s\n"
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Ne mogu da izvučem vreme isteka uverenja\n"
 
-#: gnutls.c:351 openssl.c:1611
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Uverenje klijenta je isteklo u"
 
-#: gnutls.c:353 openssl.c:1616
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Uverenje klijenta uskoro ističe"
 
-#: gnutls.c:402 openssl.c:786
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Nisam uspeo da učitam „%s“ iz smeštaja ključa: %s\n"
@@ -1023,11 +1096,11 @@ msgstr "Nisam uspeo da učitam uverenje u memoriju: %s\n"
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Nisam uspeo da postavim strukturu PKCS#12 podataka: %s\n"
 
-#: gnutls.c:493 openssl.c:555
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Nisam uspeo da dešifrujem datoteku PKCS#12 uverenja\n"
 
-#: gnutls.c:497 openssl.c:558
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Unesite PKCS#12 lozinku:"
 
@@ -1102,7 +1175,7 @@ msgstr "Nisam uspeo da dešifrujem PEM ključ: %s\n"
 msgid "Decrypting PEM key failed\n"
 msgstr "Nije uspelo dešifrovanje PEM ključa\n"
 
-#: gnutls.c:996 gnutls.c:1530 openssl.c:479
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Unesite PEM lozinku:"
 
@@ -1134,7 +1207,7 @@ msgstr "Greška učitavanja uverenja iz PKCS#11: %s\n"
 msgid "Error loading system certificate: %s\n"
 msgstr "Greška učitavanja sistemskog uverenja: %s\n"
 
-#: gnutls.c:1159 openssl.c:842
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Koristim datoteku uverenja „%s“\n"
@@ -1197,7 +1270,7 @@ msgstr "Greška uvoza PKCS#11 ključa u strukturu ličnog ključa: %s\n"
 msgid "Using private key file %s\n"
 msgstr "Koristim datoteku ličnog ključa „%s“\n"
 
-#: gnutls.c:1451 openssl.c:666
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Ovo izdanje Otvorenog povezivanja je izgrađeno bez TPM podrške\n"
 
@@ -1215,7 +1288,7 @@ msgstr "Nisam uspeo da učitam PKCS#1 lični ključ: %s\n"
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Nisam uspeo da učitam lični ključ kao PKCS#8: %s\n"
 
-#: gnutls.c:1526 gnutls.c:1559 openssl.c:1013 openssl.c:1023
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Nisam uspeo da dešifrujem datoteku PKCS#8 uverenja\n"
 
@@ -1224,7 +1297,7 @@ msgstr "Nisam uspeo da dešifrujem datoteku PKCS#8 uverenja\n"
 msgid "Failed to determine type of private key %s\n"
 msgstr "Nisam uspeo da odredim vrstu ličnog ključa „%s“\n"
 
-#: gnutls.c:1563 openssl.c:1019
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Unesite PKCS#8 lozinku:"
 
@@ -1247,7 +1320,7 @@ msgstr "Greška potvrđivanja potpisa naspram uverenja: %s\n"
 msgid "No SSL certificate found to match private key\n"
 msgstr "Nisam našao SSL uverenje koje odgovara ličnom ključu\n"
 
-#: gnutls.c:1675 openssl.c:581 openssl.c:724
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Koristim uverenje klijenta „%s“\n"
@@ -1291,158 +1364,158 @@ msgstr "Dodajem podržavajuće „%s“ izdavača uverenja\n"
 msgid "Setting certificate failed: %s\n"
 msgstr "Nisam uspeo da podesim uverenje: %s\n"
 
-#: gnutls.c:2074
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Server nije predstavio nijedno uverenje\n"
 
-#: gnutls.c:2082
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr "Greška upoređivanja uverenja servera pri ponovnom rukovanju: %s\n"
 
-#: gnutls.c:2087 openssl.c:1534
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "Server je predstavio drugačije uverenje pri ponovnom rukovanju\n"
 
-#: gnutls.c:2092 openssl.c:1537
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "Server je predstavio isto uverenje pri ponovnom rukovanju\n"
 
-#: gnutls.c:2098
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Greška pokretanja strukture X509 uverenja\n"
 
-#: gnutls.c:2104
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Greška uvoza serverskog uverenja\n"
 
-#: gnutls.c:2113 main.c:1691
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Ne mogu da izračunam heš serverskog uverenja\n"
 
-#: gnutls.c:2118
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Greška provere stanja uverenja servera\n"
 
-#: gnutls.c:2123
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "uverenje je opozvano"
 
-#: gnutls.c:2125
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "potpisnik nije pronađen"
 
-#: gnutls.c:2127
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "potpisnik nije uverenje izdavača uverenja"
 
-#: gnutls.c:2129
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "nebezbedni algoritam"
 
-#: gnutls.c:2131
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "uverenje još nije aktivirano"
 
-#: gnutls.c:2133
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "uverenje je isteklo"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2138
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "provera potpisa nije uspela"
 
-#: gnutls.c:2187 openssl.c:1418 openssl.c:1570
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "uverenje ne odgovara nazivu domaćina"
 
-#: gnutls.c:2192 openssl.c:1417 openssl.c:1576
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Nije uspela provera uverenja servera: %s\n"
 
-#: gnutls.c:2264
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 "Nisam uspeo da dodelim memoriju za uverenja datoteke izdavača uverenja\n"
 
-#: gnutls.c:2285
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Nisam uspeo da pročitam uverenja iz datoteke izdavača uverenja: %s\n"
 
-#: gnutls.c:2301
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Nisam uspeo da otvorim datoteku izdavača uverenja „%s“: %s\n"
 
-#: gnutls.c:2314 openssl.c:1698
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Nisam uspeo da učitam uverenje. Prekidam.\n"
 
-#: gnutls.c:2385
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Nisam uspeo da postavim nisku hitnosti TLS-a (%s): %s\n"
 
-#: gnutls.c:2397 openssl.c:1815
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL pregovaranje sa „%s“\n"
 
-#: gnutls.c:2444 openssl.c:1841
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL veza je otkazana\n"
 
-#: gnutls.c:2451
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "Neuspeh SSL veze: %s\n"
 
-#: gnutls.c:2460
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "Ne-kobni rezultat GnuTLS-a za vreme rukovanja: %s\n"
 
-#: gnutls.c:2466 openssl.c:1858
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Povezani ste na HTTPS sa „%s“\n"
 
-#: gnutls.c:2469
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Ponovo je dogovoren SSL na „%s“\n"
 
-#: gnutls.c:2652 openssl-pkcs11.c:199
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "Potreban je PIN za %s“"
 
-#: gnutls.c:2656 openssl-pkcs11.c:202
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Pogrešan PIN"
 
-#: gnutls.c:2659
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Ovo je poslednji pokušaj pre zaključavanja!"
 
-#: gnutls.c:2661
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Ostalo je samo nekoliko pokušaja pre zaključavanja!"
 
-#: gnutls.c:2666 openssl-pkcs11.c:206
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Unesite PIN:"
 
-#: gnutls.c:2797 openssl.c:1986
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "Nepodržani OATH HMAC algoritam\n"
 
-#: gnutls.c:2806
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Nisam uspeo da izračunam OATH HMAC: %s\n"
@@ -1639,7 +1712,7 @@ msgstr "Pokušavam HTTP Osnovno potvrđivanje identiteta sa posrednikom\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Pokušavam HTTP Osnovno potvrđivanje identiteta sa serverom „%s“\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Ovo izdanje Otvorenog povezivanja je izgrađeno bez GSSAPI podrške\n"
 
@@ -1661,241 +1734,241 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Nema više načina potvrđivanja identiteta\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Nema memorije za dodelu kolačića\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Nisam uspeo da obradim HTTP odgovor „%s“\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Dobih HTTP odgovor: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Greška obrade HTTP odgovora\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Zanemarujem nepoznati red HTTP odgovora „%s“\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Ponuđen je neispravan kolačić: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "Nije uspelo potvrđivanje identiteta SSL uverenja\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Telo odgovora ima negativnu veličinu (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Nepoznato prenosno-kodiranje: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP telo %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Greška čitanja tela HTTP odgovora\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Greška dovlačenja zaglavlja delića\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Greška dovlačenja tela HTTP odgovora\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Greška u iskomadanom dekodiranju. Očekivah „“, dobih: „%s“"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Ne mogu da primim HTTP 1.0 telo bez zatvaranja veze\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Nisam uspeo da obradim preusmerenu adresu „%s“: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Ne mogu da pratim preusmerenje na ne-https adrese „%s“\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Nije uspelo dodeljivanje nove putanje za relativno preusmerenje: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Neočekivan %d rezultat sa servera\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "zahtev je odobren"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "opšti neuspeh"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "veza nije dozvoljena skupom pravila"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "mreža je nedostižna"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "domaćin je nedostižan"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "vezu je odbio odredišni domaćin"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL je isteklo"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "naredba nije podržana / greška protokola"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "vrsta adrese nije podržana"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "SOCKS server je zatražio korisničko ime/lozinku ali mi nemamo nijedno\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "Korisničko ime i lozinka za SOCKS potvrđivanje identiteta moraju biti < 255 "
 "bajta\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 "Greška pisanja zahteva potvrđivanja identiteta na SOCKS posredniku: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 "Greška čitanja zahteva potvrđivanja identiteta sa SOCKS posrednika: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 "Neočekivan odgovor potvrđivanja identiteta sa SOCKS posrednika: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Potvrdili ste identitet na SOCKS posredniku koristeći lozinku\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Nije uspelo potvrđivanje identiteta lozinkom na SOCKS serveru\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "SOCKS server zahteva GSSAPI potvrđivanje identiteta\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "SOCKS server zahteva potvrđivanje identiteta lozinkom\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "SOCKS server zahteva potvrđivanje identiteta\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "SOCKS server zahteva nepoznatu vrstu potvrđivanja identiteta %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Zahtevam vezu SOCKS posrednika sa %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Greška pisanja zahteva povezivanja sa SOCKS posrednikom: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Greška čitanja odgovora veze sa SOCKS posrednika: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Neočekivan odgovor veze sa SOCKS posrednika: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "Greška SOCKS posrednika %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "Greška SOCKS posrednika %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Neočekivana vrsta adrese %02x u odgovoru SOCKS veze\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Zahtevam vezu HTTP posrednika sa %s:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Nisam uspeo da pošaljem zahtev posrednika: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Zahtev POVEZIVANJA posrednika nije uspeo: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Nepoznata vrsta posrednika „%s“\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Podržani su samo http ili socks(5) posrednici\n"
 
@@ -1908,16 +1981,28 @@ msgstr "Nepoznati VPN protokol „%s“\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Izgrađeno je SSL bibliotekom bez Cisko DTLS podrške\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Nisam uspeo da obradim adresu servera „%s“\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Dozvoljeno je samo „https://“ za adresu servera\n"
 
-#: library.c:1015
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Nema rukovaoca obrascem; ne mogu da potvrdim identitet.\n"
 
@@ -1933,20 +2018,25 @@ msgstr "Kobna greška u radu sa linijom naredbi\n"
 
 #: main.c:382
 #, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
+#, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "Nije uspela funkcija čitanja konzole: %s\n"
 
-#: main.c:396 main.c:409
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Greška pretvaranja ulaza konzole: %s\n"
 
-#: main.c:403 main.c:635
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Neuspeh dodeljvanja za nisku sa standardnog ulaza\n"
 
-#: main.c:570
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1955,21 +2045,21 @@ msgstr ""
 "Za ispomoć sa Otvorenim povezivanjem, pogledajte veb stranicu na\n"
 "  „http://www.infradead.org/openconnect/mail.html“\n"
 
-#: main.c:579
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Koristim OpenSSL. Prisutne funkcije:"
 
-#: main.c:581
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Koristim GnuTLS. Prisutne funkcije:"
 
-#: main.c:590
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "Nije prisutan POGON OtvorenogSSL-a"
 
-#: main.c:622
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -1979,31 +2069,31 @@ msgstr ""
 "UPOZORENJE: Nema DTLS podrške u ovoj izvršnoj. Delotvornost će biti "
 "umanjena.\n"
 
-#: main.c:659
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdul)"
 
-#: main.c:699
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Ne mogu da obradim putanju ove izvršne „%s“"
 
-#: main.c:705
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Dodela za putanju vpnc-skripte nije uspela\n"
 
-#: main.c:725
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Prepisuje naziv domaćina „%s“ sa „%s“\n"
 
-#: main.c:738
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Upotreba:  openconnect [opcije] <server>\n"
 
-#: main.c:739
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2012,308 +2102,308 @@ msgstr ""
 "Otvoreni klijent za Cisko Eni Konekt VPN, izdanje %s\n"
 "\n"
 
-#: main.c:741
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Čita opcije iz datoteke podešavanja"
 
-#: main.c:743
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Nastavlja u pozadini nakon pokretanja"
 
-#: main.c:744
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Piše PIB pozadinca u ovu datoteku"
 
-#: main.c:746
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Koristi uverenje UVER SSL klijenta"
 
-#: main.c:747
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Upozorava kada je životni vek uverenja < DANA"
 
-#: main.c:748
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Koristi KLJUČ datoteke ličnog ključa SSL-a"
 
-#: main.c:749
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Koristi kolačić KOLAČIĆ VebVPN-a"
 
-#: main.c:750
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Čita kolačić sa standardnog ulaza"
 
-#: main.c:751
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Uključuje sažimanje (osnovno)"
 
-#: main.c:752
+#: main.c:766
 msgid "Disable compression"
 msgstr "Isključuje sažimanje"
 
-#: main.c:753
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Podešava najmanji period otkrivanja neaktivnih parnjaka"
 
-#: main.c:754
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Podešava korisničku grupu prijavljivanja"
 
-#: main.c:755
+#: main.c:769
 msgid "Display help text"
 msgstr "Prikazuje tekst pomoći"
 
-#: main.c:756
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Koristi AKONAZIV za uređaj tunela"
 
-#: main.c:758
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Koristi sistemski dnevnik za poruke napredovanja"
 
-#: main.c:760
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Dodaje datum i vreme porukama napredovanja"
 
-#: main.c:761
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr "Umnožava TOS / TKLASU kada koristi DTLS"
 
-#: main.c:763
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Odbacuje ovlašćenja nakon povezivanja"
 
-#: main.c:764
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Odbacuje ovlašćenja za vreme izvršavanja CSD-a"
 
-#: main.c:765
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Pokreće SKRIPTU umesto CSD izvršne"
 
-#: main.c:767
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr "Zahteva MTU sa servera (samo stari serveri)"
 
-#: main.c:768
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Ukazuje na MTU putanju do/od servera"
 
-#: main.c:769
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Podešava lozinku ključa ili TPM SRK PIN"
 
-#: main.c:770
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Lozinka ključa je ib sistema datoteka ili sistem datoteka"
 
-#: main.c:771
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Podešava posrednički server"
 
-#: main.c:772
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Podešava načine potvrđivanja identiteta posrednika"
 
-#: main.c:773
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Isključuje posrednika"
 
-#: main.c:774
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Koristi „libproxy“ da samostalno podesi posrednika"
 
-#: main.c:776
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NAPOMENA: „libproxy“ je isključena u ovoj izgradnji)"
 
-#: main.c:778
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Zahteva savršenu tajnost prosleđivanja"
 
-#: main.c:779
+#: main.c:793
 msgid "Less output"
 msgstr "Manje izlaza"
 
-#: main.c:780
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Podešava ograničenje reda paketa na DUŽINU paketa"
 
-#: main.c:781
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "Linija naredbe školjke za korišćenje vpnc-saglasne skripte podešavanja"
 
-#: main.c:782
+#: main.c:796
 msgid "default"
 msgstr "osnovno"
 
-#: main.c:784
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Prosleđujem saobraćaj programu „script“, a ne tunu"
 
-#: main.c:786
+#: main.c:800
 msgid "Set login username"
 msgstr "Podešava korisničko ime prijavljivanja"
 
-#: main.c:787
+#: main.c:801
 msgid "Report version number"
 msgstr "Izveštava o broju izdanja"
 
-#: main.c:788
+#: main.c:802
 msgid "More output"
 msgstr "Više izlaza"
 
-#: main.c:789
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 "Ispisuje saobraćaj HTTP potvrđivanja identiteta (podrazumeva „--verbose“)"
 
-#: main.c:790
+#: main.c:804
 msgid "XML config file"
 msgstr "IksML datoteka podešavanja"
 
-#: main.c:791
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Bira izbor prijave potvrđivanja identiteta"
 
-#: main.c:792
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Samo potvrđuje identitet i ispisuje podatke o prijavi"
 
-#: main.c:793
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Samo dobavlja vebvpn kolačić; ne povezuje se"
 
-#: main.c:794
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Ispsiuje vebvpn kolačić pre povezivanja"
 
-#: main.c:795
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Datoteka uverenja za proveru servera"
 
-#: main.c:796
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Ne traži IPv6 povezivost"
 
-#: main.c:797
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "Šifreri OtvorenogSSL-a za podršku DTLS-a"
 
-#: main.c:798
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Isključuje DTLS"
 
-#: main.c:799
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Isključuje ponovno korišćenje HTTP veze"
 
-#: main.c:800
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Isključuje potvrđivanje identiteta lozinkom/Bezbednim IB-om"
 
-#: main.c:801
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Ne zahteva da SSL uverenje servera bude ispravno"
 
-#: main.c:802
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Isključuje osnovne sistemske izdavače uverenja"
 
-#: main.c:803
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Ne pokušava IksML POST potvrđivanje identiteta"
 
-#: main.c:804
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Ne očekuje korisnički unos; izlazi ako je zatražen"
 
-#: main.c:805
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Čita lozinku sa standardnog ulaza"
 
-#: main.c:806
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Vrsta softverskog modula: „rsa“, „totp“ ili „hotp“"
 
-#: main.c:807
+#: main.c:821
 msgid "Software token secret"
 msgstr "Tajna softverskog modula"
 
-#: main.c:809
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 "(NAPOMENA: „libstoken“ (RSA Bezbedni IB) je isključena u ovoj izgradnji)"
 
-#: main.c:812
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(NAPOMENA: „Yubikey“ OATH je isključen u ovoj izgradnji)"
 
-#: main.c:814
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Vremenski rok ponovnog povezivanja u sekundama"
 
-#: main.c:815
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "SHA1 otisak serverskog uverenja"
 
-#: main.c:816
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "Korisnik-Agent HTTP zaglavlja: nije uspelo"
 
-#: main.c:817
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Naziv domaćina za obaveštavanje servera"
 
-#: main.c:818
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Koristi IP prilikom povezivanja sa DOMAĆINOM"
 
-#: main.c:819
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Vrsta operativnog sistema (linux,linux-64,win,...) za izveštavanje"
 
-#: main.c:820
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Podešava mesni priključnik za DTLS datagrame"
 
-#: main.c:841
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Nisam uspeo da dodelim nisku\n"
 
-#: main.c:902
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Nisam uspeo da dobavim red iz datoteke podešavanja: %s\n"
 
-#: main.c:942
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Nepoznata opcija u %d. redu: „%s“\n"
 
-#: main.c:952
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Opcija „%s“ ne uzima argument u %d. redu\n"
 
-#: main.c:956
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Opcija „%s“ zahteva argument u %d. redu\n"
 
-#: main.c:981
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Neispravan korisnik „%s“: %s\n"
 
-#: main.c:991
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "Neispravan IB korisnika „%d“: %s\n"
 
-#: main.c:1043
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2324,7 +2414,7 @@ msgstr ""
 "         podrške ali izgleda da koristite nasleđeni znak\n"
 "         podesite „%s“. Očekujte neočekivano.\n"
 
-#: main.c:1050
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2333,42 +2423,42 @@ msgstr ""
 "UPOZORENJE: Ovo izdanje „openconnect“-a je %s ali\n"
 "         biblioteka „libopenconnect“ je %s\n"
 
-#: main.c:1060
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Nisam uspeo da dodelim strukturu vpnpodataka\n"
 
-#: main.c:1115
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Ne možete koristiti opciju „config“ unutar datoteke podešavanja\n"
 
-#: main.c:1123
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Ne mogu da otvorim datoteku podešavanja „%s“: %s\n"
 
-#: main.c:1139
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Neispravan režim zapakivanja „%s“\n"
 
-#: main.c:1160
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Nedostaje dvotačka u opciji rešavanja\n"
 
-#: main.c:1165
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Nisam uspeo da dodelim memoriju\n"
 
-#: main.c:1245 main.c:1254
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d je premalo\n"
 
-#: main.c:1284
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2379,7 +2469,7 @@ msgstr ""
 "Ako ovo pomogne, izvestite o tome na „<openconnect-devel@lists.infradead."
 "org>“.\n"
 
-#: main.c:1290
+#: main.c:1304
 #, c-format
 msgid ""
 "The --no-cert-check option was insecure and has been removed.\n"
@@ -2389,126 +2479,126 @@ msgstr ""
 "Ispravite vaše uverenje servera ili koristite „--servercert“ da mu "
 "verujete.\n"
 
-#: main.c:1307
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Nulta dužina reda nije dozvoljena; koristim 1\n"
 
-#: main.c:1321
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "Otvoreno povezivanje izdanje %s\n"
 
-#: main.c:1354
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Neispravan režim softverskog modula „%s“\n"
 
-#: main.c:1364
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Neispravan odrednik OS-a „%s“\n"
 
-#: main.c:1397
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Previše argumenata na liniji naredbi\n"
 
-#: main.c:1400
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Nije naveden server\n"
 
-#: main.c:1416
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 "Ovo izdanje otvorenog povezivanja je izgrađeno bez podrške biblioteke "
 "posrednika\n"
 
-#: main.c:1445
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Greška otvaranja spojke naredbe\n"
 
-#: main.c:1478
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Nisam uspeo da dobijem VebVPN kolačić\n"
 
-#: main.c:1499
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Nije uspelo stvaranje SSL veze\n"
 
-#: main.c:1511
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Nije uspelo podešavanje DTLS-a; koristim SSL\n"
 
-#: main.c:1531
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Povezan sam kao %s%s%s, koristim „%s%s“\n"
 
-#: main.c:1540
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr "Nije dostavljen argument „--script“; DNS i upućivanje nisu podešeni\n"
 
-#: main.c:1542
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Pogledajte „http://www.infradead.org/openconnect/vpnc-script.html“\n"
 
-#: main.c:1555
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Nisam uspeo da otvorim „%s“ radi upisa: %s\n"
 
-#: main.c:1567
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Nastavljam rad u pozadini, pib %d\n"
 
-#: main.c:1584
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Korisnik je zatražio ponovno povezivanje\n"
 
-#: main.c:1592
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Kolačić je odbačen pri ponovnom povezivanju; izlazim.\n"
 
-#: main.c:1596
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Server je okončao sesiju; izlazim.\n"
 
-#: main.c:1600
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Korisnik je otkazao (SIGINT); izlazim.\n"
 
-#: main.c:1604
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Korisnik se otkačio sa sesije (SIGHUP); izlazim.\n"
 
-#: main.c:1608
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Nepoznata greška; izlazim.\n"
 
-#: main.c:1627
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Nisam uspeo da otvorim „%s“ radi upisa: %s\n"
 
-#: main.c:1635
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Nisam uspeo da upišem podešavanja u „%s“: %s\n"
 
-#: main.c:1694
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Serversko SSL uverenje ne odgovara: %s\n"
 
-#: main.c:1713
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2519,101 +2609,101 @@ msgstr ""
 "Nije uspelo potvrđivanje uverenja sa VPN servera „%s“.\n"
 "Razlog: %s\n"
 
-#: main.c:1716
+#: main.c:1730
 #, c-format
 msgid ""
 "To trust this server in future, perhaps add this to your command line:\n"
 msgstr "Da i dalje verujete ovom serveru, dodajte ovo na liniju naredbi:\n"
 
-#: main.c:1717
+#: main.c:1731
 #, c-format
 msgid "    --servercert %s\n"
 msgstr "    --servercert %s\n"
 
-#: main.c:1722
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Unesite „%s“ da prihvatite, „%s“ da prekinete; bilo šta drugo da pregledate: "
 
-#: main.c:1723 main.c:1741
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ne"
 
-#: main.c:1723 main.c:1729
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "da"
 
-#: main.c:1750
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Heš serverskog ključa: %s\n"
 
-#: main.c:1784
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Izbor potvrđivanja identiteta „%s“ se poklapa sa više opcija\n"
 
-#: main.c:1787
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Izbor potvrđivanja „%s“ nije dostupan\n"
 
-#: main.c:1808
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Korisnički ulaz je zatražen u nemeđudejstvenom režimu\n"
 
-#: main.c:1985
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Nisam uspeo da otvorim datoteku modula radi upisa: %s\n"
 
-#: main.c:1993
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Nisam uspeo da zapišem modul: %s\n"
 
-#: main.c:2039 main.c:2060
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Niska softverskog modula je neispravna\n"
 
-#: main.c:2042
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Ne mogu da otvorim datoteku „~/.stokenrc“\n"
 
-#: main.c:2045
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "Otvoreno povezivanje nije izgrađeno sa podrškom „libstoken“-a\n"
 
-#: main.c:2048
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Opšti neuspeh u „libstoken“-u\n"
 
-#: main.c:2063
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "Otvoreno povezivanje nije izgrađeno sa podrškom „liboath“-a\n"
 
-#: main.c:2066
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Opšti neuspeh u „liboath“-u\n"
 
-#: main.c:2077
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Nisam našao modul Jubi ključa\n"
 
-#: main.c:2080
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "Otvoreno povezivanje nije izgrađeno sa podrškom Jubi ključa\n"
 
-#: main.c:2083
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Opšti neuspeh Jubi ključa: %s\n"
@@ -2628,16 +2718,16 @@ msgstr "Podešavanje tun skripte nije uspelo\n"
 msgid "Set up tun device failed\n"
 msgstr "Podešavanje tun uređaja nije uspelo\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Pozivnik je pauzirao vezu\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Besposlen sam; odspavaću %d ms...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "Čekanje na više objekata nije uspelo: %s\n"
@@ -2706,7 +2796,7 @@ msgstr "Server odbija softverski modul; prelazim na ručni unos\n"
 msgid "Generating OATH TOTP token code\n"
 msgstr "Stvaram kod OATH TOTP modula\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Stvaram kod OATH HOTP modula\n"
 
@@ -2838,138 +2928,222 @@ msgstr "Dobih KMP poruku %d veličine %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Primih ne-ESP TLV-a (grupa %d) u ESP pregovora KMP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Greška stvaranja zahteva oNCP pregovaranja\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Kratko pisanje u oNCP pregovaranju\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Čitam %d bajta SSL zapisa\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Neočekivani odgovor veličine %d nakon paketa naziva domaćina\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Odgovor servera paketu naziva domaćina je greška 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Neispravan paket čeka na KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Očekivah KMP poruku 301 sa servera ali dobih %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "KMP poruka 301 sa servera je prevelika (%d bajta)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Dobih KMP poruku 301 veličine %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Nisam uspeo da pročitam dužinu zapisa nastavka\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "Zapis dodatna %d bajta je prevelik; napraviću %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Nisam uspeo da pročitam zapis nastavka dužine %d\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Čitam dodatna %d bajta KMP 301 poruke\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Greška pregovaranja ESP ključa\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "novo dolazno"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "novo odlazno"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "Zanemarujem ESP ključeve pošto ESP podrška nije dostupna u ovom izdanju\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Čitam samo 1 bajt oNCP dužine polja\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "Server je okončao vezu (sesija je istekla)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "Server je okončao vezu (razlog: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "Server je poslao oNCP zapis nulte dužine\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "Dolazna KMP poruka %d veličine %d (dobih %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr "Nastavljam da obrađujem KMP poruku %d sada veličine %d (dobih %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Nepoznati paket podataka\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Nepoznata KMP poruka %d veličine %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d bajtova neprimljenih\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Odlazni paket:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Poslah kontrolni paket ESP uključivanja\n"
 
-#: openconnect-internal.h:1054 openconnect-internal.h:1062
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "GREŠKA: „%s()“ je pozvano sa neispravnim UTF-8 za argument „%s“\n"
 
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Nisam uspeo da napravim „SSL_SESSION ASN.1“ za OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "Open SSL nije uspeo da obradi „SSL_SESSION ASN.1“\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Nije uspelo pokretanje DTLSv1 sesije\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Nije uspelo pokretanje DTLSv1 CTH-a\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr "Podešavanje DTLS CTIks izdanja nije uspelo\n"
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Nije uspelo postavljanje spiska DTLS šifrera\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Nije baš jedan DTLS šifrer\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"Funkcija „SSL_set_session()“ nije uspela sa starim izdanjem protokola 0x%x\n"
+"Da li koristite izdanje OpenSSL-a starije od 0.9.8m?\n"
+"Vidite “http://rt.openssl.org/Ticket/Display.html?id=1751“\n"
+"Koristite opciju „--no-dtls“ da izbegnete ovu poruku\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+"Uspostavljena je DTLS veza (koristim Otvoreni SSL). Komplet šifrera %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"Vaš Otvoreni SSL je stariji od onog koji ste izgradili s njim, tako da DTLS "
+"možda neće uspeti!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Verovatno zato što je oštećen vaš Otvoreni SSL\n"
+"Vidite „http://rt.openssl.org/Ticket/Display.html?id=2984“\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "Nije uspelo DTLS rukovanje: %d\n"
+
 #: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Nisam uspeo da pokrenem ESP šifrera:\n"
@@ -3065,7 +3239,7 @@ msgstr "Nisam uspeo da nađem PKCS#11 uverenje „%s“\n"
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "libp11 nije dovukla sadržaj H.509 uverenja\n"
 
-#: openssl-pkcs11.c:412 openssl.c:728
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Nisam uspeo da instaliram uverenje u OpenSSL kontekst\n"
 
@@ -3116,260 +3290,260 @@ msgstr "Dodavanje ključa iz PKCS#11 nije uspelo\n"
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Ovo izdanje Otvorenog povezivanja je izgrađeno bez PKCS#11 podrške\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Nisam uspeo da pišem na SSL priključnicu\n"
 
-#: openssl.c:184 openssl.c:250
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Nisam uspeo da čitam sa SSL priključnice\n"
 
-#: openssl.c:279
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "Greška SSL čitanja %d (server je verovatno zatvorio vezu); ponovo se "
 "povezujem.\n"
 
-#: openssl.c:304
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "Nije uspelo SSL_pisanje: %d\n"
 
-#: openssl.c:378
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Nepoznata vrsta zahteva KS SSL-a %d\n"
 
-#: openssl.c:486
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM lozinka je preduga (%d >= %d)\n"
 
-#: openssl.c:519
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Dodatno uverenje iz „%s“: %s\n"
 
-#: openssl.c:569
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Nije uspela obrada PKCS#12 (vidite greške iznad)\n"
 
-#: openssl.c:584
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 ne sadrži uverenje!\n"
 
-#: openssl.c:593
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 ne sadrži lični ključ!\n"
 
-#: openssl.c:598
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:616
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Ne mogu da učitam TPM pogon.\n"
 
-#: openssl.c:622
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Nisam uspeo da pokrenem TPM pogon\n"
 
-#: openssl.c:632
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Nisam uspeo da podesim TPM SRK lozinku\n"
 
-#: openssl.c:646
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Nisam uspeo da učitam TPM lični ključ\n"
 
-#: openssl.c:652
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Dodavanje ključa iz TPM-a nije uspelo\n"
 
-#: openssl.c:702 openssl.c:850
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Nisam uspeo da otvorim datoteku uverenja „%s“: %s\n"
 
-#: openssl.c:712
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Nisam uspeo da učitam uverenje\n"
 
-#: openssl.c:750
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr "Nisam uspeo da obradim sva podržavajuća uverenja. Ipak pokušavam...\n"
 
-#: openssl.c:763
+#: openssl.c:776
 msgid "PEM file"
 msgstr "PEM datoteka"
 
-#: openssl.c:792
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Nisam uspeo da napravim BIO za stavku smeštaja ključeva „%s“\n"
 
-#: openssl.c:817
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Učitavanje ličnog ključa nije uspelo (pogrešna lozinka?)\n"
 
-#: openssl.c:823
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Učitavanje ličnog ključa nije uspelo (vidite greške iznad)\n"
 
-#: openssl.c:873
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Nisam uspeo da učitam H509 uverenje iz smeštaja ključa\n"
 
-#: openssl.c:879
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Nisam uspeo da koristim H509 uverenje iz smeštaja ključa\n"
 
-#: openssl.c:911
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Nisam uspeo da koristim lični ključ iz smeštaja ključa\n"
 
-#: openssl.c:927
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Nisam uspeo da otvorim datoteku ličnog ključa „%s“: %s\n"
 
-#: openssl.c:947 openssl.c:962 openssl.c:983 openssl.c:1049
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Učitavanje ličnog ključa nije uspelo\n"
 
-#: openssl.c:1043
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr "Nisam uspeo da pretvorim PKCS#8 u OpenSSL EVP_PKLJUČ\n"
 
-#: openssl.c:1060
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Nisam uspeo da odredim vrstu ličnog ključa u „%s“\n"
 
-#: openssl.c:1222
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Poklopih DNS zamenski naziv „%s“\n"
 
-#: openssl.c:1229
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Nema poklapanja za zamenski naziv „%s“\n"
 
-#: openssl.c:1243
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Uverenje ima zamenski naziv „GEN_IPADD“ sa prividnom dužinom %d\n"
 
-#: openssl.c:1254 openssl.c:1400
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Poklopljena je %s adresa „%s“\n"
 
-#: openssl.c:1261
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Nema poklapanja za %s adresu „%s“\n"
 
-#: openssl.c:1303
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "Putanja „%s“ ima ne-praznu putanju; zanemarujem\n"
 
-#: openssl.c:1308
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Odgovarajuća putanja „%s“\n"
 
-#: openssl.c:1319
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Nema poklapanja za putanju „%s“\n"
 
-#: openssl.c:1334
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Nema odgovarajućeg zamenskog naziva u uverenju parnjaka „%s“\n"
 
-#: openssl.c:1342
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Nema naziva teme u uverenju parnjaka!\n"
 
-#: openssl.c:1362
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Nisam uspeo da obradim naziv teme u uverenju parnjaka\n"
 
-#: openssl.c:1369
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Tema uverenja parnjaka ne odgovara ('%s' != '%s')\n"
 
-#: openssl.c:1374 openssl.c:1408
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Odgovarajući naziv teme uverenja parnjaka „%s“\n"
 
-#: openssl.c:1470
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Dodatno uverenje iz datoteke izdavača uverenja: %s\n"
 
-#: openssl.c:1608
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Greška u polju nije_nakon u uverenju klijenta\n"
 
-#: openssl.c:1621
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<greška>"
 
-#: openssl.c:1674
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr "Stvaranje TLSv1 CTIks-a nije uspelo\n"
 
-#: openssl.c:1693
+#: openssl.c:1705
 msgid "SSL certificate and key do not match\n"
 msgstr "SSL uverenje i ključ se ne podudaraju\n"
 
-#: openssl.c:1738
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Nisam uspeo da pročitam uverenja iz datoteke izdavača uverenja „%s“\n"
 
-#: openssl.c:1771
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Nisam uspeo da otvorim datoteku izdavača uverenja „%s“\n"
 
-#: openssl.c:1831
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "Neuspeh SSL veze\n"
 
-#: openssl.c:1992
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Nisam uspeo da izračunam OATH HMAC\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Odbacujem uključivanja loše podele: „%s“\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Odbacujem isključivanja loše podele: „%s“\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Nisam uspeo da izrodim skriptu „%s“ za %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Skripta „%s“ je izašla neispravno (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Skripta „%s“ je dala grešku %d\n"
@@ -3671,87 +3845,99 @@ msgstr "Neispravan zapis PIN-a; pokušajte ponovo.\n"
 msgid "Generating RSA token code\n"
 msgstr "Stvaram kod RSA modula\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Greška pristupa ključu registra za mrežnim prilagođivačima\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Zanemarujem ne-podudarajući TAP uređaj „%s“\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 "Nisam našao Vindouz-TAP prilagođivače. Da li je instaliran upravljački "
 "program?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Nisam uspeo da otvorim „%s“\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Otvorio sam tun uređaj „%s“\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Nisam uspeo da dobijem izdanje TAP upravljačkog programa: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Greška: Potreban je upravljački program TAP-Vindouza v9.9 ili veći (nađoh "
 "%ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Nisam uspeo da podesim TAP IP adrese: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Nisam uspeo da podesim stanje TAP medija: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "TAP uređaj je prekinuo povezivost. Prekidam vezu.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Nisam uspeo da čitam sa TAP uređaja: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Nisam uspeo da dovršim čitanje sa TAP uređaja: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Zapisah %ld bajta na tunu\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Čekam na zapisivanje tuna...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Zapisah %ld bajta na tunu nakon čekanja\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Nisam uspeo da pišem na TAP uređaj: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Izrađanje tunelskih skripti još nije podržano na Vindouzu\n"
 
@@ -4057,71 +4243,3 @@ msgstr "naredba izračunavanja"
 #: yubikey.c:608
 msgid "Unrecognised response from Yubikey when generating tokencode\n"
 msgstr "Nepoznat odgovor sa Jubi ključa prilikom stvaranja koda modula\n"
-
-#~ msgid "using OpenSSL"
-#~ msgstr "koristim OtvoreniSSL"
-
-#~ msgid "Failed to recv DPD request (%d): %s\n"
-#~ msgstr "Nisam uspeo da primim DPD zahtev (%d): %s\n"
-
-#~ msgid "Failed to send DPD request (%d): %s\n"
-#~ msgstr "Nisam uspeo da pošaljem DPD zahtev (%d): %s\n"
-
-#~ msgid "Too long time in MTU detect loop; bailing out.\n"
-#~ msgstr "Predugo vreme u petlji MTU otkrivanja; izvlačim se.\n"
-
-#~ msgid "SSL operation cancelled\n"
-#~ msgstr "SSL radnja je otkazana\n"
-
-#~ msgid "DTLS handshake failed: %d\n"
-#~ msgstr "Nije uspelo DTLS rukovanje: %d\n"
-
-#~ msgid ""
-#~ "This is probably because your OpenSSL is broken\n"
-#~ "See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-#~ msgstr ""
-#~ "Verovatno zato što je oštećen vaš Otvoreni SSL\n"
-#~ "Vidite „http://rt.openssl.org/Ticket/Display.html?id=2984“\n"
-
-#~ msgid ""
-#~ "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-#~ msgstr ""
-#~ "Vaš Otvoreni SSL je stariji od onog koji ste izgradili s njim, tako da "
-#~ "DTLS možda neće uspeti!"
-
-#~ msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-#~ msgstr ""
-#~ "Uspostavljena je DTLS veza (koristim Otvoreni SSL). Komplet šifrera %s.\n"
-
-#~ msgid ""
-#~ "SSL_set_session() failed with old protocol version 0x%x\n"
-#~ "Are you using a version of OpenSSL older than 0.9.8m?\n"
-#~ "See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-#~ "Use the --no-dtls command line option to avoid this message\n"
-#~ msgstr ""
-#~ "Funkcija „SSL_set_session()“ nije uspela sa starim izdanjem protokola 0x"
-#~ "%x\n"
-#~ "Da li koristite izdanje OpenSSL-a starije od 0.9.8m?\n"
-#~ "Vidite “http://rt.openssl.org/Ticket/Display.html?id=1751“\n"
-#~ "Koristite opciju „--no-dtls“ da izbegnete ovu poruku\n"
-
-#~ msgid "Not precisely one DTLS cipher\n"
-#~ msgstr "Nije baš jedan DTLS šifrer\n"
-
-#~ msgid "Set DTLS cipher list failed\n"
-#~ msgstr "Nije uspelo postavljanje spiska DTLS šifrera\n"
-
-#~ msgid "Set DTLS CTX version failed\n"
-#~ msgstr "Podešavanje DTLS CTIks izdanja nije uspelo\n"
-
-#~ msgid "Initialise DTLSv1 CTX failed\n"
-#~ msgstr "Nije uspelo pokretanje DTLSv1 CTH-a\n"
-
-#~ msgid "Initialise DTLSv1 session failed\n"
-#~ msgstr "Nije uspelo pokretanje DTLSv1 sesije\n"
-
-#~ msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-#~ msgstr "Open SSL nije uspeo da obradi „SSL_SESSION ASN.1“\n"
-
-#~ msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-#~ msgstr "Nisam uspeo da napravim „SSL_SESSION ASN.1“ za OpenSSL: %s\n"
diff --git a/po/sv.po b/po/sv.po
index 14a9e38c..aa462f66 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Swedish (http://www.transifex.net/projects/p/meego/team/sv/)\n"
@@ -173,7 +173,7 @@ msgstr "Frågade efter lösenord men ”--no-passwd” var angivet\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "Hämtar inte XML-profil eftersom SHA1 redan matchar\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "Misslyckades med att öppna HTTPS-anslutningen till %s\n"
@@ -308,549 +308,482 @@ msgstr "(Fel vid beskrivning av fel!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "FEL: Kan inte initiera uttag (sockets)\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr "KRITISKT FEL: DTLS-huvudhemlighet är ej initierad. Rapportera detta.\n"
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "Fel vid skapandet av HTTP CONNECT-begäran\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "Fel vid hämtning av HTTPS-svar\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN-tjänst otillgänglig, orsak: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Tog emot opassande HTTP CONNECT-svar: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "Tog emot CONNECT-svar: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Inget minne för alternativ\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID är inte 64 tecken, är: ”%s”\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Okänd DTLS-Content-Encoding %s\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Okänd CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Ingen MTU mottagen. Avbryter\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Ingen IP-adress mottagen. Avbryter\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "IPv6-konfiguration mottagen men MTU %d är för liten.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Återanslutning gav en annan föråldrad IP-adress (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Återanslutning gav en annan föråldrad IP-nätmask (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Återanslutning gav en annan föråldrad IPv6-adress (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Återanslutning gav en annan IPv6-nätmask (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CTSP ansluten. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP Ciphersuite: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Komprimeringsstart misslyckades\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Allokering av komprimeringsbuffert misslyckades\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "dekomprimering misslyckades\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "LZS-dekomprimering misslyckades: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr "LZ4-dekomprimering misslyckades\n"
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr "Okänd komprimeringstyp %d\n"
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "Tog emot %s komprimerade datapaket av %d byte (var %d)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "dekomprimering misslyckades %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Allokering misslyckades\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Kort paket mottogs (%d bytes)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Oväntad paketlängd. SSL_read returnerade %d men paket är\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "Mottog emot CSTP DPD-begäran\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "Mottog CSTP DPD-svar\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "Mottog CSTP Keepalive\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "Mottog dekomprimerade datapaket av %d byte\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Mottog serverfrånkoppling: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr "Mottog serverfrånkoppling\n"
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "Komprimerade paket mottogs i !komprimerat läge\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "mottog paket serveravslut\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Okänt paket %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL skrev för få byte! Frågade efter %d, skickade %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CTSP rekey due\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Återhandskakning misslyckades; provar ny tunnel\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CSTP Dead Peer Detection upptäckte en död motpart!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Återanslutning misslyckades\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "Skicka CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "Skicka CSTP Keepalive\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr "Skickar komprimerade datapaket för %d byte (var %d)\n"
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "Skickar okomprimerade datapaket på %d byte\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "Skickar BYE-paket: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Försöker med Digest-autentisering till proxy\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr "Försöker med Digest-autentisering till servern ”%s”\n"
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr "Misslyckades med att skapa SSL_SESSION ASN.1 för OpenSSL: %s\n"
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr "OpenSSL misslyckades med att tolka SSL_SESSION ASN.1\n"
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "Misslyckades med att initiera DTLSv1-session\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "Misslyckades med att initiera DTLSv1 CTX\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "Misslyckades med att sätta DTLS chifferlista\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Ej ett DTLS-chiffer\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"SSL_set_session() misslyckades med gammal protokollversion 0x%x\n"
-"Använder du en version av OpenSSL äldre än 0.9.8m?\n"
-"Se http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Använd kommandoradsalternativet --no-dtls för att undvika detta meddelande\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "Etablerade DTLS-anslutning (använder OpenSSL). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr "DTLS-anslutningskomprimering med %s.\n"
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr "Din OpenSSL är äldre än den du byggde mot, DTLS kan misslyckas!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS-handskakning överskred tidsgränsen\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Det är antagligen för att din OpenSSL är trasig\n"
-"Se http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS-handskakning misslyckades: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "Okända DTLS-parametrar för begärd Ciphersuite ”%s”\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "Misslyckades med att sätta DTLS-prioritet: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "Misslyckades att sätta DTLS-sessionsparametrar: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "Misslyckades att sätta DTLS MTU: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "Etablerade DTLS-anslutning (använder GnuTLS). Ciphersuite %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "DTLS-handskakning misslyckades: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(Hindrar en brandvägg dig från att skicka UDP-paket?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "Försökte DTLS-ansluta med existerande fd\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "Ingen DTLS-adress\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Server erbjöd inget DTLS-chifferalternativ\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Ingen DTLS när ansluten via proxy\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS-alternativ %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS initierad. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Försöker med ny DTLS-anslutning\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "Hämtade DTLS-paket 0x%02x av %d byte\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "Mottog DTLS DPD-begäran\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "Misslyckades med att skicka DPD-svar. Förvänta frånkoppling\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "Mottog DTLS DPD-svar\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "Mottog DTLS Keepalive\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Komprimerade DTLS-paket mottaget när komprimering inte var aktiverat\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Okänt DTLS-pakettyp %02x, län %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS rekey due\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "DTLS-återhandskakning misslyckades, återansluter.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS Dead Peer Detection upptäckte en död motpart!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "Skicka DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "Misslyckades med att skicka DPD-begäran. Förvänta frånkoppling\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "Skicka DTLS Keepalive\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Misslyckades med att skicka keepalive-begäran. Förvänta frånkoppling\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Okänt paket (län %d) mottog: %02x %02x %02x %02x…\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS fick skrivfel %d. Faller tillbaka till SSL\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS fick skrivfel %s. Faller tillbaka till SSL\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "Skickade DTLS-paket på %d byte, DTLS send returnerade %d\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
-msgstr "SSL-anslutning avbruten\n"
-
-#: dtls.c:1169
+#: dtls.c:507
 #, c-format
 msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr "Initierar MTU-upptäckt för IPv4 (min=%d, max=%d)\n"
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
-msgstr "För lång tid i MTU-upptäcktsslinga; hoppar ur.\n"
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:531
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
-msgstr "Misslyckades med att skicka DPD-begäran (%d): %s\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
+msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
+msgstr ""
+
+#: dtls.c:544
+#, c-format
+msgid "Failed to send DPD request (%d %d)\n"
+msgstr ""
+
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr "Mottog oväntat paket (%.2x) i MTU-upptäckt; hoppar över.\n"
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
-msgstr "Misslyckades med att ta emot DPD-begäran (%d): %s\n"
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr "Initierar MTU-upptäckt för IPv6\n"
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr "Upptäckte MTU på %d byte (var %d)\n"
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr "Ingen ändring i MTU efter upptäckt (var %d)\n"
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr "Accepterar förväntat ESP-paket med seq %u\n"
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Förkastar föråldrat ESP-paket med seq %u (förväntade %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr ""
+"Accepterar senare-än-väntat ESP-paket med seq %u (förväntade %<PRIu64>)\n"
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr "Accepterar ESP-paket i oordning med seq %u (förväntade %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Förkastar föråldrat ESP-paket med seq %u (förväntade %<PRIu64>)\n"
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr "Förkastar återuppspelat ESP-paket med seq %u\n"
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
-msgstr ""
-"Accepterar senare-än-väntat ESP-paket med seq %u (förväntade %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgstr "Accepterar ESP-paket i oordning med seq %u (förväntade %<PRIu64>)\n"
 
 #: esp.c:68
 #, c-format
@@ -951,6 +884,97 @@ msgstr "Misslyckades med att skicka ESP-paket: %s\n"
 msgid "Sent ESP packet of %d bytes\n"
 msgstr "Skickade ESP-paket på %d byte\n"
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "Okända DTLS-parametrar för begärd Ciphersuite ”%s”\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "Misslyckades med att sätta DTLS-prioritet: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "Misslyckades att sätta DTLS-sessionsparametrar: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "Misslyckades att sätta DTLS MTU: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "Etablerade DTLS-anslutning (använder GnuTLS). Ciphersuite %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr "DTLS-anslutningskomprimering med %s.\n"
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS-handskakning överskred tidsgränsen\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "DTLS-handskakning misslyckades: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(Hindrar en brandvägg dig från att skicka UDP-paket?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -971,7 +995,7 @@ msgstr "Misslyckades med att generera slumpmässiga nycklar för ESP: %s\n"
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr "Misslyckades med att beräkna HMAC för ESP-paket: %s\n"
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr "Mottog ESP-paket med ogiltig HMAC\n"
 
@@ -990,7 +1014,7 @@ msgstr "Misslyckades med att generera ESP-paket IV: %s\n"
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr "Misslyckades med att kryptera ESP-paket: %s\n"
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL-skrivning avbruten\n"
 
@@ -999,487 +1023,491 @@ msgstr "SSL-skrivning avbruten\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Misslyckades med att skriva till SSL-uttag (socket): %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL-läsning avbruten\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "SSL-uttag (socket) stängde orent\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Misslyckades med att läsa från SSL-uttag (socket): %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "SSL-läsfel: %s, återansluter.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "SSL send misslyckades: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Kunde inte extrahera tidsgräns för certifikat\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "Klientcertifikat har passerat tidsgränsen"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "Klientcertifikat passerar snart tidsgräns"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Misslyckades med att läsa in objektet ”%s” från nyckellager: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Misslyckades med att öppna nyckel-/certifikatfil %s: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "Misslyckades med stat nyckel-/certifikatfil %s: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Misslyckades med att allokera buffert för certifikat\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Misslyckades med att läsa in certifikat till minnet: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Misslyckades med att ställa in PKCS#12-datastrukturen: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "Misslyckades med att dekryptera PKCS#12-certifikatfil\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "Ange PKCS#12-lösenfras:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Misslyckades med att behandla PKCS#12-filen: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Misslyckades med att läsa PKCS#12-certifikatet: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Misslyckades med import av X509-certifikatet: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Misslyckades med att sätta PKCS#11-certifikatet: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "Kunde inte initiera MD5-hash: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "MD5-hashfel: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Saknar DEK-Info: huvud from OpenSSL-krypterad nyckel\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "Kan inte bestämma PEM-kryngstyp\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "PEM-krypteringstypen: %s stöds ej\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr "Ogiltigt salt i krypterad PEM-fil\n"
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Fel base64-decoding krypterad PEM-fil: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Krypterad PEM-fil för kort\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "Misslyckades med att initiera chiffer för att dekryptera PEM-fil: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "Misslyckades med att kryptera PEM-nyckel: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "Dekryptering av PEM-nyckel misslyckades\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "Ange PEM-lösenfras:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Denna binär är byggd utan stöd för systemnyckel\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Denna binär är byggd utan stöd för PKCS#11\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Använder PKCS#11-certifikatet %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "Använder systemcertifikatet %s\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Fel vid inläsning av certifikat från PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Fel vid inläsning av systemcertifikatet: %s\n"
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "Använder certifikatfilen %s\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "PKCS#11-filen innehöll inget certifikat\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Inget certifikat hittades i filen"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Misslyckades med att läsa in certifikatet: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "Använder systemnyckeln %s\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Fel vid initiering av privata nyckelstrukturen: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Fel vid import av systemnyckeln %s: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "Provar PKCS#11-nyckel-URL %s\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "Fel vid initiering av PKCS#11-nyckelstruktur: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Fel vid import av PKCS#11-URL %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Använder PKCS#11-nyckeln %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr "Fel vid import av PKCS#11-nyckeln till privata nyckelstrukturen: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Använder privata nyckelfilen %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "Denna version av OpenConnect byggdes utan TPM-stöd\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "Misslyckades med att tolka PEM-fil\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "Misslyckades med att läsa in PKCS#1-privata nyckeln: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Misslyckades med att läsa in privat nyckel som PKCS#8: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "Misslyckades med att dekryptera PKCS#8-certifikatfil\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "Misslyckades med att bestämma typ av privat nyckel %s\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "Ange PKCS#8-lösenfras:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Misslyckades med att hämta nyckel-ID: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Fel vid signering av testdata med privata nyckeln: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Fel vid validering av signatur mot certifikat: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Hittade inget SSL-certifikat som matchade privat nyckel\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "Använder klientcertifikatet ”%s”\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "Misslyckades med att sätta certifikatindragningslistan: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Misslyckades med att allokera minne för certifikat\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "VARNING: GnutTLS returnerade ogiltiga utfärdarcertifikat, autentisering kan "
 "misslyckas!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "Erhöll nästa CA ”%s” från PKCS11\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Misslyckades med att allokera minne för att stödja certifikat\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Lägger till stöd för CA ”%s”\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Misslyckades med att sätta certifikatet: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Server presenterade inget certifikat\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr "Fel vid jämförelse av servercertifikat vid återhandskakning: %s\n"
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr "Server presenterade annat certifikat vid återhandskakning\n"
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr "Server presenterade identiskt certifikat vid återhandskakning\n"
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "Fel vid initiering av X509-certifikatstruktur\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Fel vid import av servercertifikat\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Kunde inte beräkna hash för serverns certifikat\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Fel vid kontroll av status för servercertifikat\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "certifikat indraget"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "undertecknare inte funnen"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "undertecknare inte ett CA-certifikat"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "osäker algoritm"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "certifikat inte aktiverat"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "certifikat har överskridit tidsgräns"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "signaturverifiering misslyckades"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "certifikat matcher inte värdnamn"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Verifiering av servercertifikat misslyckades: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "Misslyckades med att allokera minne för cafile-certifikat\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "Misslyckades med att läsa certifikat från cafile: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "Misslyckades med att öppna CA-filen ”%s”: %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Misslyckades med att läsa in certifikat. Avbryter.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr "Misslyckades med att sätta TLS-prioritetssträngen (”%s”): %s\n"
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "SSL-förhandling med %s\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL-anslutning avbruten\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL-anslutning misslyckades: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS icke-kritisk retur vid handskakning; %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "Ansluten till HTTPS på %s\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "Omförhandlade SSL på %s\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "PIN krävs för %s"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Fel PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Detta är sista försöket innan låsning!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Bara ett fåtal försök kvar innan låsning!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Ange PIN:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr "OATH HMAC algoritm stöds inte\n"
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr "Misslyckades med att beräkna OATH HMAC: %s\n"
@@ -1675,7 +1703,7 @@ msgstr "Försöker med HTTP Basic-autentisering till proxy\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr "Försöker med HTTP Basic-autentisering till servern ”%s”\n"
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "Denna version av OpenConnect byggdes utan GSSAPI-stöd\n"
 
@@ -1697,236 +1725,236 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Inga fler autentiseringsmetoder att prova\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Inget minne för att allokera kakor\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "Misslyckades med att tolka HTTP-svaret ”%s”\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Mottog HTTP-svaret: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "Fel vid bearbetning av HTTP-svar\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Ignorerar okänd HTTP-svarsrad ”%s”\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Ogiltig kaka erbjuden: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL-certifikatsautentisering misslyckades\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Svarskropp har negativ storlek (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Okänd överföringskodning: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP-kropp %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "Fel vid läsning av HTTP-svarskropp\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Fel vid hämtning av chunk-huvud\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "Fel vid hämtning av HTTP-svarskropp\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Fel i chunked-avkodning. Förväntade ””, fick: ”%s”"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Kan inte hämta HTTP 1.0-body utan att stänga anslutning\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Misslyckades med att tolka omdirigerad URL ”%s”: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "Kan inte följa omdirigering till icke https-URL ”%s”\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "Misslyckades med att allokera ny sökväg för relativ omdirigering: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Oväntat resultat %d från server\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "begäran tillåten"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "allmänt fel"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "anslutning inte tillåten av regeluppsättning"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "nätverk ej nåbart"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "värd ej nåbar"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "anslutning vägras av målvärd"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL tidsgräns har överskridits"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "kommando stöds ej / protokollfel"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "adresstyp stöds ej"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr "SOCKS-server begärde användarnamn/lösenord men vi har inga\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "Användarnamn och lösenord för SOCKS-autentisering måste vara < 255 byte\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "Fel vid skrivning av auth-begäran till SOCKS-proxy: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "Fel vid läsning av auth-svar från SOCKS-proxy: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "Oväntat auth-svar från SOCKS-proxy: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "Autentiserad till SOCKS-server med lösenord\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "Lösenordsautentisering till SOCKS-server misslyckades\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "SOCKS-server begärde GSSAPI-autentisering\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "SOCKS-server begärde lösenordsautentisering\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "SOCKS-server begärde autentisering\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "SOCKS-server begärde okänd autentiseringstyp %02x\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Begär SOCKS-proxyanslutning till %s: %d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "Fel vid skrivning av anslutningsbegäran till SOCKS-proxy: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "Fel vid läsning av anslutningssvar från SOCKS-proxy: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "Oväntat anslutningssvar från SOCKS-proxy: %02x %02x…\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS-proxyfel %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS-proxyfel %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "Oväntad adresstyp %02x i SOCKS-anslutningssvar\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "Begär HTTP-proxyanslutning till %s: %d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Misslyckades med att skicka proxybegäran: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Misslyckades med proxy CONNECT-begäran: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Okänd proxytyp ”%s”\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Endast http eller socks(5)-proxyservrar stöds\n"
 
@@ -1939,45 +1967,62 @@ msgstr "Okänt VPN-protokoll ”%s”\n"
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "Byggd mot SSL-bibliotek utan Cisco DTLS-stöd\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Misslyckades med att tolka server-URL ”%s”\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Endast https:// tillåtet för server-URL\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Ingen formhanterare, kan inte autentisera.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr "CommandLineToArgvW() misslyckades: %s\n"
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr "Kritiskt misstag i kommandoradshantering\n"
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() misslyckades: %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Fel vid konvertering av konsolinmatning: %s\n"
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "Allokeringsfel för sträng från stdin\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1986,25 +2031,21 @@ msgstr ""
 "För hjälp med OpenConnect, se webbsidan på\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "Använder OpenSSL. Egenskaper:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "Använder GnuTLS. Egenskaper:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL ENGINE inte tillgänglig"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "använder OpenSSL"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2013,31 +2054,31 @@ msgstr ""
 "\n"
 "VARNING: Inget DTLS-stöd i denna binär. Prestanda kommer att påverkas.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Kan inte bearbeta denna körbara sökväg ”%s”"
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "Allokering för vpnc-skriptsökväg misslyckades\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr "Åsidosätt värdnamnet ”%s” till ”%s”\n"
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Användning:  openconnect [flaggor] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2046,307 +2087,307 @@ msgstr ""
 "Öppen klient för Cisco AnyConnect VPN, version %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Läs flaggor från konfigurationsfil"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Fortsätt i bakgrunden efter start"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Skriv demonens PID till denna fil"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "Använd SSL-klientcertifikat CERT"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Varna när certifikatets livslängd < DAYS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "Använd privata SSL-nyckelfilen KEY"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "Använd WebVPN-kakan COOKIE"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Läs kaka från standard in"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Aktivera komprimering (standard)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Inaktivera komprimering"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Sätt minsta intervall för Dead Peer Detection"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Sätt användargrupp för inloggning"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Visa hjälptext"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Använd IFNAME för tunnelgränssnitt"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "Använd syslog för förloppsmeddelanden"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "Lägg till tidsstämpel i början av förloppsmeddelanden"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Förkasta privilegier efter anslutning"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "Förkasta rättigheter under CSD-körning"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "Kör SCRIPT istället för CSD-binär"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Indikerar sökvägs-MTU till/från server"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Sätt lösenfras för nyckel ett TPM SRK PIN"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Nyckellösenfras är fsid för filsystemet"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Sätt proxyserver"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Sätt proxyautentiseringsmetoder"
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Inaktivera proxy"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Använd libproxy för att automatiskt konfigurera proxy"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(OBS: libproxy inaktiverad i detta bygge)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Kräver perfect forward secrecy"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Mindre utmatning"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "Sätt paketkögräns till LEN-pkts"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 "Skalkommandorad för att använda ett vpnc-kompatibelt konfigurationsskript"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "standard"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Sänd trafik till ”script”-program, inte tun"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Sätt användarnamn för inloggning"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Rapportera versionsnummer"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Mer utmatning"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "Dumpa HTTP-autentiseringstrafik (implicerar --verbose"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML-konfigurationsfil"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Välj autentiseringinloggningsmarkering"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Autentisera endast och skriv ut inloggningsinformation"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Hämta endast webvpn-kaka, anslut ej"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Skriv ut webvpn-kaka innan anslutning"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Certifikatfil för serververifiering"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "Fråga inte efter IPv6-anslutning"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "OpenSSL-chiffer till stöd för DTLS"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "Inaktivera DTLS"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "Inaktivera återanvändning av HTTP-anslutning"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Inaktivera lösenord-/SecurID-autentisering"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Kräv inte server-SSL-certifikat att vara giltigt"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Inaktivera standardutfärdarna för systemcertifikat"
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "Försök inte med XML POST-autentisering"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Förvänta inte användarinmatning, avsluta om det krävs"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Läs lösenord från standardinmatning"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Programvarutokentyp: rsa, totp eller hotp"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Programvarutokenhemlighet"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(OBS: libstoken (RSA SecurID) inaktiverat i detta bygge)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(OBS: Yubikey OATH inaktiverat i detta bygge)"
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Tidsgräns för återanslutningsförsök i sekunder"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "SHA1-fingeravtryck för serverns certifikat"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP-header User-Agent:-fält"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr "Lokalt värdnamn att annonsera till server"
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr "Använd IP vid anslutning till VÄRD"
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "OS-typ (linux,linux-64,win,…) att rapportera"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "Sätt lokal port för DTLS-datagram"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Misslyckades med att allokera sträng\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Misslyckades med att hämta rad från konfigurationsfilen %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "Okänd flagga på rad %d: ”%s”\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "Alternativet ”%s” tar inte argument på rad %d\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "Alternativet ”%s” kräver ett argument på rad %d\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr "Ogiltig användare ”%s”: %s\n"
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr "Ogiltigt användar-ID ”%d”: %s\n"
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2357,7 +2398,7 @@ msgstr ""
 "         men du verkar använda den föråldrade teckenuppsättningen\n"
 "         ”%s”. Förvänta dig konstiga händelser.\n"
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2366,42 +2407,42 @@ msgstr ""
 "VARNING: Denna version av openconnect är %s men\n"
 "         biblioteket libopenconnect är %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Misslyckades med att allokera vpninfo-struktur\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Kan inte använda ”config” inuti konfigurationsfil\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Kan inte öppna konfigurationsfilen ”%s”: %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr "Ogiltigt komprimeringsläge ”%s”\n"
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr "Saknar kolon i flaggan för uppslag\n"
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr "Misslyckades med att allokera minne\n"
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d för litet\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2410,125 +2451,132 @@ msgstr ""
 "Inaktiverar alla HTTP-anslutningsåteranvändningar pga --no-http-keepalive.\n"
 "Om detta hjälper, rapportera till  <openconnect-devel@lists.infradead.org>.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Kölängd noll tillåts inte: använder 1\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect version %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Ogiltigt programvarutokenläge ”%s”\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Ogiltig OS-identitet ”%s”\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "För många argument på kommandoraden\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Ingen server angiven\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Denna version av OpenConnect byggdes utan libproxy-stöd\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "Fel vid öppning av cmd-rör\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "Misslyckades med att erhålla WebVpn-kaka\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "Misslyckades med att skapa SSL-anslutning\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "Misslyckades med att ställa in DTLS, använder SSL istället\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr "Ansluten som %s%s%s, använder %s%s\n"
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Inget --script-argument givet, DNS och omdirigering är inte konfigurerade\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "Se http://www.infradead.org/openconnect/vpnc-script.html\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "Misslyckades med att öppna ”%s” för att skriva: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Fortsätter i bakgrunden, pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Användare begärde återanslutning\n"
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Kaka avvisades vid återanslutning, avslutar.\n"
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Sessionen avslutades av server, avslutar.\n"
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Användare avbröt (SIGINT), avslutar.\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Användare frånkopplade från session (SIGHUP), avslutar.\n"
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Okänt fel, avslutar.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Misslyckades med att öppna %s för att skriva: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "Misslyckades med att skriva konfiguration till %s: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "SSL-servercertifikat matchade inte: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2539,91 +2587,102 @@ msgstr ""
 "Certifikatet från VPN-servern \"%s\" klarade inte verifiering.\n"
 "Anledning: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Skriv in ”%s” för att acceptera, ”%s” för att avbryta, vad som helst annat "
 "för att visa: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "nej"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "ja"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Hash för servernyckel: %s\n"
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Auth-val ”%s” matchar flera alternativ\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Auth-val ”%s” ej tillgängligt\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Användarinmatning krävs i icke-interaktivt läge\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Misslyckades med att öppna tokenfil för skrivning: %s\n"
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Misslyckades med att skriva token: %s\n"
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Programvarutokensträng är ogiltig\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "Kan inte öppna ~/.stokenrc-fil\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect byggdes inte med libstoken-stöd\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Allmänt fel i libstoken\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect byggdes inte med liboath-stöd\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Allmänt fel i liboath\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Yubikey-token inte funnen\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "OpenConnect byggdes inte med Yubikey-stöd\n"
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Allmänt Yubikey-fel: %s\n"
@@ -2638,16 +2697,16 @@ msgstr "Misslyckades med att ställa in skript för tun\n"
 msgid "Set up tun device failed\n"
 msgstr "Misslyckades med att ställa in tun-enhet\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Anslutaren pausade anslutningen\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Inget arbete att göra, sover i %d ms…\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "WaitForMultipleObjects misslyckades: %s\n"
@@ -2714,7 +2773,7 @@ msgstr "Server förkastar programvarutoken, växlar till manuellt angiven\n"
 msgid "Generating OATH TOTP token code\n"
 msgstr "Genererar OATH TOTP tokenkod\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "Genererar OATH HOTP tokenkod\n"
 
@@ -2846,502 +2905,617 @@ msgstr "Erhöll KMP-meddelande %d med storlek %d\n"
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr "Erhöll icke-ESP TLVs (grupp %d) i ESP-förhandling KMP\n"
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr "Fel vid skapande av begäran av oNCP-förhandling\n"
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr "Kort skrivning i oNCP-förhandling\n"
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr "Läste %d byte av SSL-post\n"
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr "Oväntat svar på storlek %d efter värdnamnspaket\n"
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr "Serversvar till värdnamnspaket är fel 0x%02x\n"
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr "Ogiltigt paket väntar på KMP 301\n"
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr "Förväntad KMP-meddelande 301 från server, men fick %d\n"
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr "KMP-meddelande 301 från server för stort (%d byte)\n"
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr "Erhöll KMP-meddelande 301 med längd %d\n"
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr "Misslyckades med att läsa fortsättning på postens längd\n"
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr "Post på ytterligare %d byte för stor; skulle bli %d\n"
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr "Misslyckades med att läsa ytterligare post på längd %d\n"
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr "Läs ytterligare %d byte av KMP-301-meddelande\n"
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr "Fel vid förhandling av ESP-nycklar\n"
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr "ny inkommande"
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr "ny utgående"
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 "Ignorerar ESP-nycklar eftersom ESP-stöd inte är tillgängligt i detta bygge\n"
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr "Läs bara 1 byte från fältet för oNCP-längd\n"
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr "Servern avslutade anslutningen (sessionens tidsgräns passerades)\n"
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr "Servern avslutade anslutningen (orsak: %d)\n"
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr "Servern skickade oNCP-post med längd 0\n"
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr "Inkommande KMP-meddelande %d med storlek %d (fick %d)\n"
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr "Fortsätter att bearbeta KMP-meddelande %d med storlek %d (fick %d)\n"
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr "Okänt datapaket\n"
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr "Okänt KMP-meddelande %d med storlek %d:\n"
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ".... + %d mer byte ej mottaget\n"
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr "Utgående paket:\n"
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr "Skicka ESP enable control-paket\n"
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "FEL: %s() anropades med ogiltig UTF-8 för ”%s” argument\n"
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr "Misslyckades med att skapa SSL_SESSION ASN.1 för OpenSSL: %s\n"
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr "OpenSSL misslyckades med att tolka SSL_SESSION ASN.1\n"
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "Misslyckades med att initiera DTLSv1-session\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "Misslyckades med att initiera DTLSv1 CTX\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "Misslyckades med att sätta DTLS chifferlista\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Ej ett DTLS-chiffer\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"SSL_set_session() misslyckades med gammal protokollversion 0x%x\n"
+"Använder du en version av OpenSSL äldre än 0.9.8m?\n"
+"Se http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Använd kommandoradsalternativet --no-dtls för att undvika detta meddelande\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "Etablerade DTLS-anslutning (använder OpenSSL). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr "Din OpenSSL är äldre än den du byggde mot, DTLS kan misslyckas!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Det är antagligen för att din OpenSSL är trasig\n"
+"Se http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS-handskakning misslyckades: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr "Misslyckades med att initiera ESP-chiffer:\n"
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr "Misslyckades med att initiera ESP HMAC\n"
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr "Misslyckades med att generera nycklar för ESP:\n"
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr "Misslyckades med att ställa in dekryptering för ESP-paket:\n"
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr "Misslyckades med att dekryptera ESP-paket:\n"
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr "Misslyckades med att generera slumpmässiga IV för ESP-paket:\n"
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr "Misslyckades med att ställa in krypteringskontext för ESP-paket:\n"
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr "Misslyckades med att kryptera ESP-paket:\n"
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr "Misslyckades med att etablera libp11 PKCS#11-kontext:\n"
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr "Misslyckades med att läsa in PKCS#11-leverantörsmodul (%s):\n"
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN-låst\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN-tidsgräns överskriden\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "En annan användare är redan inloggad\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr "Okänt fel vid inloggning till PKCS#11-token\n"
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr "Inloggad till PKCS#11-platsen ”%s”\n"
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr "Misslyckades med att räkna upp certifikat i PKCS#11-platsen ”%s”\n"
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr "Fann %d certifikat på plats ”%s”\n"
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr "Misslyckades med att tolka PKCS#11 URI ”%s”\n"
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr "Misslyckades med att räkna upp PKCS#11-platser\n"
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr "Loggar in till PKCS#11-platsen ”%s”\n"
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "Certifikat X.509-innehåll hämtas inte med libp11\n"
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "Misslyckades med att installera certifikat i OpenSSL-kontext\n"
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr "Misslyckades med att räkna upp nycklar i PKCS#11-platsen ”%s”\n"
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr "Fann %d nycklar på plats ”%s”\n"
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr "Misslyckades med instansiera privat nyckel från PKCS#11\n"
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr "Misslyckades med att lägga till nyckel från PKCS#11\n"
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "Denna version av OpenConnect byggdes utan PKCS#11-stöd\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Misslyckades med att skriva till SSL-uttag (socket)\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "Misslyckades med att läsa från SSL-uttag (socket)\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr "SSL-läsfel %d (server stängde antagligen anslutning), återansluter.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write misslyckades: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "Ohanterad SSL UI-begärantyp %d\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM-lösenord för långt (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "Extra certifikat från %s: ”%s”\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "Misslyckades med att tolka PKCS#12 (se fel ovan)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12-filen innehöll inget certifikat!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 innehöll inga privata nycklar!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "Kan inte läsa in TPM-motor.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "Misslyckades med att initiera TPM-motor\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "Misslyckades med att sätta TPM SRK-lösenord\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "Misslyckades med att läsa in TPM-privat nyckel\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "Misslyckades med att lägga till nyckel från TPM\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "Misslyckades med att öppna certifikatfil %s: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Misslyckades med att läsa in certifikat\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr "Misslyckades med att bearbeta certifikat som stöds. Försöker ändå…\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "PEM-fil"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Misslyckades med att skapa BIO för nyckellagringsobjektet ”%s”\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Misslyckades med att läsa in privat nyckel (fel lösenfras)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Inläsning av privat nyckel misslyckades (se fel ovan)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Misslyckades med att läsa in X509-certifikat från nyckellager\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Misslyckades med att använda X509-certifikat från nyckellager\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Misslyckades med att använda privat nyckel från nyckellager\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "Misslyckades med att öppna privat nyckelfil %s: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Misslyckades med att läsa in privat nyckel\n"
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "Misslyckades med att identifiera privat nyckeltyp i ”%s\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Matchade DNS-altname ”%s”\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Ingen match för altname ”%s”\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Certifikat har GEN_IPADD altname med påhittad längd %d\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "Matchade %s adress ”%s”\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "Ingen match för %s adress ”%s”\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI ”%s” har icke-tom sökväg, ignorerar\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Matchade URI ”%s”\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "Ingen match för URI ”%s”\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Inget altnamn i motparts certifikat matchade ”%s”\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Inget ämnesnamn i motparts certifikat!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Misslyckades med att tolka ämnesnamn i motparts certifikat\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Motparts certifikat matchar ej ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Matchade motparts certifikat ämnesnamn ”%s”\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "Extra certifikat från cafile: ”%s”\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "Fel i klientcertifikat notAfter-fält\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<fel>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "Misslyckades med att läsa certifikat från CA-fil ”%s”\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "Misslyckades med att öppna CA-filen ”%s”\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL-anslutning misslyckades\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr "Misslyckades med att beräknaOATH HMAC\n"
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "Förkasta dålig delning inkluderande: ”%s”\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "Förkasta dålig delning exkluderande: ”%s”\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "Misslyckades med att generera skript ”%s” för %s: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "Skriptet ”%s” avslutades onormalt (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Skriptet ”%s” returnerade fel %d\n"
@@ -3638,83 +3812,95 @@ msgstr "Ogiltigt PIN-format, prova igen.\n"
 msgid "Generating RSA token code\n"
 msgstr "Genererar RSA-tokenkod\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Fel vid åtkomst av registernyckel för nätverksadapters\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Ignorerar ej matchande TAP-gränssnitt ”%s”\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Inga Windows-TAP-adaptrar hittades. Är drivrutinen installerad?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "Misslyckades med att öppna %s\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Öppnade tun-enhet %s\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "Misslyckades med att erhålla TAP-drivrutin i version: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr "Fel: TAP-Windows drivrutin v9.9 eller större krävs (fann %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "Misslyckades med att ange TAP IP-adress: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "Misslyckades med att sätta TAP mediastatus: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "TAP-enhet avslutade anslutning. Kopplar från.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "Misslyckades med att läsa från TAP-enhet: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "Misslyckades med att läsa från TAP-enhet: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "Skrev %ld byte till tun\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Väntar på tun-skrivning…\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Skrev %ld byte till tun efter väntan\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "Misslyckades med att skriva till TAP-enhet: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Att generera tunnelskript stöds ännu inte på Windows\n"
 
diff --git a/po/ta.po b/po/ta.po
index f6783cb7..91aae875 100644
--- a/po/ta.po
+++ b/po/ta.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Tamil (http://www.transifex.net/projects/p/meego/team/ta/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/te.po b/po/te.po
index d8914adb..54f42e0a 100644
--- a/po/te.po
+++ b/po/te.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: network-manager-openconnect.po.master.te\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2009-08-21 00:04+0530\n"
 "Last-Translator: Krishna Babu K <kkrothap@redhat.com>\n"
 "Language-Team: Telugu <en@li.org>\n"
@@ -173,7 +173,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -300,541 +300,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -936,6 +875,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -956,7 +986,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -975,7 +1005,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -984,485 +1014,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1656,7 +1690,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1674,235 +1708,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1915,407 +1949,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2323,173 +2370,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2497,89 +2551,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2594,16 +2659,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2669,7 +2734,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2801,501 +2866,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3592,83 +3766,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/tg.po b/po/tg.po
index ad695b54..9bd79e23 100644
--- a/po/tg.po
+++ b/po/tg.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Tajik (http://www.transifex.net/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/tg_TJ.po b/po/tg_TJ.po
index bb8e5887..57f43502 100644
--- a/po/tg_TJ.po
+++ b/po/tg_TJ.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Tajik (Tajikistan) (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/th.po b/po/th.po
index 50f39468..b03ae09a 100644
--- a/po/th.po
+++ b/po/th.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Thai (http://www.transifex.net/projects/p/meego/team/th/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/tl.po b/po/tl.po
index acd5b57c..09add1c6 100644
--- a/po/tl.po
+++ b/po/tl.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Tagalog (http://www.transifex.net/projects/p/meego/team/tl/)\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/tl_PH.po b/po/tl_PH.po
index b13c270c..f8d43ee0 100644
--- a/po/tl_PH.po
+++ b/po/tl_PH.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Tagalog (Philippines) (http://www.transifex.net/projects/p/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/tr.po b/po/tr.po
index 3e9e23ad..2f686fe0 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Turkish (http://www.transifex.net/projects/p/meego/team/tr/)\n"
@@ -170,7 +170,7 @@ msgstr "Parola soruluyor ama '--no-passwd' ayarlanmış\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr "SHA1 özeti zaten eşleştiğinden dolayı XML profili indirilemiyor\n"
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "%s hedefine HTTPS bağlantısı açılamadı\n"
@@ -307,549 +307,480 @@ msgstr "(Hata tanımlama sırasında hata!)"
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr "HATA: Soketler başlatılamıyor\n"
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr "HTTPS CONNECT isteği oluşturmada hata\n"
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "HTTPS cevabı getirilirken hata\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN hizmeti kullanılamıyor; nedeni: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "Uygun olmayan HTTP CONNECT yanıtı alındı: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "CONNECT yanıtı alındı: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "Seçenekler için bellek yok\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr "<elided>"
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID, 64 karakter değil, uzunluğu: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr "Bilinmeyen DTLS-Content-Encoding %s\n"
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "Bilinmeyen CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "Hiçbir MTU alınamadı. Durduruluyor\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "Hiçbir IP adresi alınamadı. Durduruluyor\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr "IPv6 yapılandırması alındı fakat MTU %d çok küçük.\n"
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "Yeniden bağlantı farklı eski bir IP adresi getirdi (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "Yeniden bağlantı eski bir IP ağ maskesi getirdi (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "Yeniden bağlantı farklı IPv6 adresi getirdi (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "Yeniden bağlantı farklı bir IPv6 ağ maskesi getirdi (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP bağlandı. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr "CSTP Şifreleme: %s\n"
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "Sıkıştırma kurulumu başarısız oldu\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "Sıkıştırılmış tampon ayırma başarısız\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "şişirmek başarısız\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr "LZS açma işlemi başarısız oldu: %s\n"
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr "%s bayt %d sıkıştırılmış veri paketi alındı (%d idi)\n"
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "sıkıştırma başarısız %d\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr "Yer ayırma başarısız oldu\n"
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr "Kısa paket alındı (%d bayt)\n"
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "Beklenmeyen paket uzunluğu. SSL_read %d döndü fakat paket\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "CSTP DPD isteği alındı\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "CSTP DPD yanıtı alındı\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "CSTP Keepalive alındı\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "%d bayt sıkıştırılmamış veri paketi alındı\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "Sunucu bağlantı kesimi: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "!deflate kipinde sıkıştırılmış paket alındı\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "sunucu kapatma paketi alındı\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "Bilinmeyen paket %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL çok az bayt yazdı! İstenen %d, gönderilen %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP yeniden anahtarlama zamanı\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr "Yeniden elsıkışma başarısız oldu; yeni-tünel deneniyor\n"
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr "CTSP Ölü Uç Tespiti ölü uç tespit etti!\n"
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "Yeniden bağlanılamadı\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "CSTP DPD gönder\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "CSTP Keepalive Gönder\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "%d bayt sıkıştırılmamış veri paketi gönderiliyor\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "BYE paketi gönder: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr "Vekil sunucusuna Digest kimlik doğrulaması deneniyor\n"
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "DTLSv1 oturumu başlatma başarısız\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "DTLSv1 CTX başlatma başarısız\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "DTLS şifre listesi ayarlama başarısız\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "Tam bir DTLS şifresi değil\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"Eski protokol sürümü 0x%x ile SSL_set_session() başarısız oldu\n"
-"OpenSSL'in 0.9.8m'den daha eski bir sürümünü mü kullanıyorsunuz?\n"
-"http://rt.openssl.org/Ticket/Display.html?id=1751 adresine bakın\n"
-"Bu iletiyi engellemek için --no-dtls komut satırı seçeneğini kullan\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr "DTLS bağlantısı sağlandı (OpenSSL kullanarak). Ciphersuite %s.\n"
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"OpenSSL'iniz derlediklerinizden daha eski, bu yüzden DTLS hata alabilir!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS elsıkışması zaman aşımına uğradı\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-"Bu muhtemelen OpenSSL'inizin bozulmasından dolayıdır\n"
-"http://rt.openssl.org/Ticket/Display.html?id=2984 adresine bakın\n"
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS elsıkışması başarısız oldu: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-"Sunucudan istenen Şifreleme Listesi '%s' için bilinmeyen DTLS parametreleri\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "DTLS önceliği ayarlanamadı: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "DTLS oturum parametreleri ayarlanamadı: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "DTLS MTU ayarlanamadı: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr "DTLS bağlantısı kuruldu (GnuTLS kullanarak). Şifreleme %s.\n"
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "DTLS elsıkışması başarısız oldu: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr "(Güvenlik duvarı UDP paketi göndermenizi engelliyor mu?)\n"
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr "DTLS bağlantısı var olan bir fd ile denendi\n"
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "DTLS adresi yok\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "Sunucu hiçbir DTLS şifreleme seçeneği sunmadı\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "Vekil sunucu yolu ile bağlandığında DTSL yok\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS seçeneği %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr "DTLS sıfırlandı. DPD %d, Keepalive %d\n"
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "Yeni DTLS bağlantısı girişimi\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "DTLS paketinin 0x%02x / %d kadarı alındı\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "DTLS DPD isteği alındı\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "DPD yanıtı gönderimi başarısız. Bağlantının kesilmesi bekleniyor\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "DTLS DPD yanıtı alındı\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "DTLS Keepalive alındı\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr "Sıkıştırma etkin değilken sıkıştırılmış DTLS paketi alındı\n"
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "Bilinmeyen DTLS paket türü %02x, uzunluğu %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS yeniden anahtarlama zamanı\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr "DTLS Elsıkışması başarısız; yeniden bağlanılıyor.\n"
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr "DTLS Ölü Uç Tespiti ölü bir uç tespit etti!\n"
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "DTLS DPD Gönder\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "DPD istek gönderimi başarısız. Bağlantı kesilebilir\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "DTLS Keepalive gönder\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "Keepalive isteği gönderimi başarısız. Bağlantı kesilebilir\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "Bilinmeyen paket (uzunluk %d) alındı: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS %d yazma hatası aldı. Bağlantı SSL'e düşürülüyor\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS yazma hatası aldı: %s. Bağlantı SSL'e düşürülüyor\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "%d bayt DTLS paketi gönderildi; DTLS %d döndürdü\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Failed to recv DPD request (%d)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:589
+#, c-format
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
+msgstr ""
+
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -951,6 +882,98 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+"Sunucudan istenen Şifreleme Listesi '%s' için bilinmeyen DTLS parametreleri\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "DTLS önceliği ayarlanamadı: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "DTLS oturum parametreleri ayarlanamadı: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "DTLS MTU ayarlanamadı: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr "DTLS bağlantısı kuruldu (GnuTLS kullanarak). Şifreleme %s.\n"
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS elsıkışması zaman aşımına uğradı\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "DTLS elsıkışması başarısız oldu: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr "(Güvenlik duvarı UDP paketi göndermenizi engelliyor mu?)\n"
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -971,7 +994,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -990,7 +1013,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL yazması iptal edildi\n"
 
@@ -999,488 +1022,492 @@ msgstr "SSL yazması iptal edildi\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "SSL soketine yazılamadı: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL okuma iptal edildi\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr "SSL soket temiz olmayan bir şekilde kapattı\n"
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "SSL soketten okunamadı: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "SSL okuma hatası: %s; yeniden bağlanılıyor.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "SSL gönder başarısız oldu: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Sertifikanın sona erme tarihi alınamadı\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "İstemci sertifikasının süresi doldu"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "İstemci sertifikası yakında sona erecek"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "Anahtar deposundan '%s' ögesi yüklenemedi: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "Anahtar/sertifika dosyası %s açılamadı: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "%s anahtarının/sertifika dosyasının konumu belirlenemedi: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Sertifika tampon belleği ayrılamadı\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Bellekteki sertifika okunamadı: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "PKCS#12 veri yapısı kurulamadı: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "PKCS#12 sertifika dosyasının şifresi açılamadı\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "PKCS#12 anahtar parolası girin:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "PKCS#12 dosyası işletilemedi: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "PKCS#12 sertifika yüklemesi başarısız oldu: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "X509 sertifika içeri aktarma işlemi başarısız: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "PKCS#11 sertifika ayarlanması başarısız oldu: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "MD5 özeti başlatılamadı: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "MD5 özet hatası: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr "Eksik DEK-Bilgisi: OpenSSL şifrelenmiş anahtardan bir başlık\n"
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "PEM şifreleme türü tespit edilemiyor\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "Desteklenmeyen PEM şifreleme türü: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "Şifrelenmiş PEM dosyasında base64-decoding hatası: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "Şifrelenmiş PEM dosyası çok kısa\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "PEM dosyası şifresini açmak için şifre oluşturma başarısız oldu: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "PEM anahtar şifresi açılamadı: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "PEM anahtar şifresi açma işlemi başarısız\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "PEM parolası girin:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr "Bu ikili dosya sistem anahtar desteği olmadan derlenmiş\n"
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "Bu ikili dosya PKCS#11 desteği olmadan derlendi\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "PKCS#11 sertifikası %s kullanılıyor\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr "Sistem sertifikası %s kullanılıyor\n"
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "PKCS#11'den sertifika yüklenirken hata: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr "Sistem sertifikası yüklenirken hata: %s\n"
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "%s sertifika dosyası kullanılıyor\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "PKCS#11 dosyası hiçbir sertifika içermiyor\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "Dosyada hiçbir sertifika bulunamadı"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Sertifika yüklenirken başarısız oldu: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr "Sistem anahtarı %s kullanılıyor\n"
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Özel anahtar yapısı oluşturulurken hata: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr "Sistem anahtarı %s içeri aktarılırken hata: %s\n"
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr "PKCS#11 anahtar URL'i %s deneniyor\n"
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "PKCS#11 anahtar yapısı oluşturulurken hata: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "PKCS#11 URL %s içeri aktarılırken hata: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "PKCS#11 anahtarı %s kullanılıyor\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 "Özel anahtar yapısındaki PKCS#11 anahtarı içeri aktarılırken hata: %s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Özel anahtar dosyası %s kullanılıyor\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "OpenConnect'in bu sürümü TPM desteği olmadan derlendi\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "PEM dosyası yorumlanamadı\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "PKCS#11 özel anahtarı yüklenemedi: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "Özel anahtar PKCS#8 olarak yüklenemedi: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "PKCS#8 sertifika dosyasının şifresi açılamadı\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "%s özel anahtarının türü tespit edilemedi\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "PKCS#8 anahtar parolası girin:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "Anahtar kimliği alımı başarısız oldu: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr "Test verisi özel anahtar ile imzalanırken hata: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr "Sertifika imzası onaylanırken hata: %s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "Özel anahtar ile eşleşen sertifika bulunamadı\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "İstemci sertifikası '%s' kullanılıyor\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr "Sertifika için bellek ayrılamadı\n"
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "UYARI: GnuTLS hatalı sertifika sağlayıcı bilgisi dönüyor; kimlik doğrulama "
 "işlemi başarısız sonuçlanabilir!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr "PKCS11'dan sonraki CA '%s' alındı\n"
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "Desteklenen sertifikalar için bellek ayrılamadı\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Desteklenen CA '%s' ekleniyor\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Sertifika ayarlama başarısız: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Sunucu hiçbir sertifika sunamadı\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "X509 sertifika yapısı oluşturulurken hata\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "Sunucunun sertifikası içeri aktarılırken hata\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr "Sunucunun sertifikasının özeti hesaplanamadı\n"
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Sunucu sertifika durumu kontrol edilirken hata\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "sertifika iptal edildi"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "imza sahibi bulunamadı"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "imza sahibi bir CA sertifikası değil"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "güvensiz algoritma"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "sertifika henüz etkinleştirilmemiş"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "sertifikanın süresi dolmuş"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "imza doğrulama başarısız"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "sertifika ana bilgisayar adı ile eşleşmiyor"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "Sunucu sertifika doğrulaması başarısız oldu: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "cafile sertifikaları için bellek ayırma başarısız\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "cafile üzerinden sertifika okuma başarısız: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "CA dosyası '%s' açma başarısız: %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "Sertifika yükleme başarısız oldu. Durduruluyor.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "%s ile SSL anlaşması\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL bağlantısı iptal edildi\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL bağlantı hatası: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "GnuTLS el sıkışma sırasında ölümcül olmayan bir hata döndürdü: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "%s üzerinden HTTPS bağlanıldı\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr "%s üzerindeki SSL yeniden değerlendirildi\n"
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "%s için PIN gerekli"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Yanlış PIN"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Bu kilitlemeden önce son deneme hakkınızdır!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "Kilitlemeden önce sadece birkaç deneme hakkınız kaldı!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "PIN Girin:"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1676,7 +1703,7 @@ msgstr "Vekile HTTP Temel kimlik doğrulaması deneniyor\n"
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr "OpenConnect'in bu sürümü GSSAPI desteği olmadan derlendi\n"
 
@@ -1695,237 +1722,237 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr "Denenecek kimlik doğrulama yöntemi kalmadı\n"
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "Çerezlere ayrılacak bellek yok\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "HTTP yanıtı '%s' ayrıştırılamadı\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "HTTP yanıtı alındı: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "HTTP yanıtı işlenirken hata\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "Bilinmeyen HTTP yanıt satırı '%s' yoksayılıyor\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Geçersiz çerez verildi: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL sertifikası kimlik doğrulama hatası\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "Yanıt gövdesi sıfırdan küçük bir boyutta (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "Bilinmeyen Transfer-Encoding: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP gövde %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "HTTP yanıt gövdesi okunurken hata\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "Yığın başlık getirilirken hata\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr "HTTP yanıt gövdesi getirilirken hata\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "Yığın halinde çözmede hata. Beklenen \", alınan: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "Bağlantı kapatılmadan HTTP 1.0 gövdesi alınamıyor\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "Yeniden yönlendirme URL'i '%s' ayrıştırması başarısız: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "https-olmayan yönlendirme adresi '%s' takip edilemez\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "İlgili yeniden yönlendirme için yeni yol tahsisi başarısız: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "Sunucudan beklenmeyen %d sonucu\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "istek kabul edildi"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "genel hata"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "kural kümesine göre bağlantıya izin verilmiyor"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "ağ erişilemez durumda"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "makine erişilemez durumda"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "bağlantı hedef makine tarafından reddedildi"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL süresi doldu"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "komut desteklenmiyor / protokol hatası"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "adres türü desteklenmiyor"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 "SOCKS sunucusu kullanıcı adı/parola istedi fakat hiçbiri mevcut değil\n"
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 "SOCKS kimlik doğrulaması için kullanıcı adı ve parola < 255 bayt olmalıdır\n"
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "SOCKS vekil sunucusuna kimlik doğrulama isteği yazılırken hata: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "SOCKS vekilinden kimlik doğrulama yanıtı okunurken hata: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "SOCKS vekilinden beklenmeyen kimlik doğrulama yanıtı: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr "SOCKS sunucusuna parola kullanılarak kimlik doğrulandı\n"
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr "SOCKS sunucusuna parola kimlik doğrulaması başarısız oldu\n"
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr "SOCKS sunucusu GSSAPI kimlik doğrulaması istedi\n"
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr "SOCKS sunucusu parola kimlik doğrulaması istedi\n"
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr "SOCKS sunucusu kimlik doğrulama gerektirir\n"
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr "SOCKS sunucusu bilinmeyen %02x kimlik doğrulama türünü ister\n"
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "Şuradan SOCKS vekil bağlantısı isteniyor %s:%d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr "SOCKS vekiline bağlantı isteği yazarken hata: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "SOCKS vekilinden bağlantı yanıtı okunurken hata: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "SOCKS vekilinden beklenmeyen bağlantı yanıtı: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS vekil hatası %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS vekil hatası %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "SOCKS bağlantı adresinde beklenmeyen adres türü %02x\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "%s sunucusuna HTTP vekil bağlantısı isteniyor:%d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "Vekil sunucu isteği gönderme başarısız oldu: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "Vekil sunucu CONNECT isteği başarısız oldu: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "Bilinmeyen vekil sunucu türü '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "Sadece http ya  da socks(5) vekilleri destekleniyor\n"
 
@@ -1938,45 +1965,62 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "SSL kütüphanesini Cisco DTLS desteği olmadan derle\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "Sunucu URL'i '%s' ayrıştırma işlemi başarısız oldu\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "Sunucu URL'i için sadece https:// izinli\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "Form işleyicisi yok; kimlik doğrulanamıyor.\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr "CommandLineToArgvW() başarısız oldu: %s\n"
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr "Komut satırı işlemede önemli hata\n"
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr "ReadConsole() başarısız oldu: %s\n"
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr "Konsol girdisi dönüştürülürken hata: %s\n"
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "stdin'den gelen karakter dizisi için yer tahsis etme hatası\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1986,25 +2030,21 @@ msgstr ""
 "  http://www.infradead.org/openconnect/mail.html adresindeki web\n"
 "sayfasına bakın\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "OpenSSL kullanılıyor. Mevcut özellikler:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "GnuTLS kullanılıyor. Mevcut özellikler:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL MOTORU mevcut değil"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "OpenSSL kullanarak"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2013,31 +2053,31 @@ msgstr ""
 "\n"
 "UYARI: Bu ikilide DTLS desteklenmiyor. Performans bozulacaktır.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr "Bu çalıştırılabilir yol \"%s\" işlenemiyor"
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr "vpnc betik yolu için yer ayırma başarısız\n"
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "Kullanım:  openconnect [seçenekler]<server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2046,306 +2086,306 @@ msgstr ""
 "Cisco AnyConnect VPN için istemci aç, sürüm %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "Yapılandırma dosyasından seçenekleri oku"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "Başlangıçtan sonra arkaplanda devam et"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "Artalan işlemin PID bilgisini bu dosyaya yaz"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "SSL istemci sertifikası CERT kullan"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "Sertifika ömrü < DAYS durumuna geldiğinde uyar"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "SSL özel anahtar dosyası KEY kullan"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "WebVPN çerezi COOKIE kullan"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "Standart girdiden çerez oku"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "Sıkıştırmayı etkinleştir (öntanımlı)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "Sıkıştırmayı kapat"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr "Asgari Ölü Uç Tespit aralığı ayarla"
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "Giriş kullanıcı grubu ayarla"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "Yardım metnini göster"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "Tünel arayüzü için IFNAME kullan"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "İlerleme mesajları için syslog'u kullan"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr "İlerleme mesajları için zaman damgasını başa ekle"
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "Bağlandıktan sonra ayrıcalıkları bırak"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "CSD çalıştırma sırasında ayrıcalıkları bırak"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "CSD ikiliği yerine SCRIPT çalıştır"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "Sunucudan/sunucuya MTU yolu belirtin"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "Anahtar parolası ya da TPM SRK PIN ayarla"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "Anahtar parolası dosya sisteminin fsid'sidir"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "Vekil sunucu ayarla"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr "Vekil sunucu kimlik doğrulama yöntemlerini ayarla"
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "Vekili kapat"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "Vekili otomatik yapılandırmak için libproxy kullan"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(NOTE: Bu derlemede libproxy devredışı bırakıldı)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr "Mükemmel ileri gizlilik iste"
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "Daha az çıktı"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "LEN pkts için paket kuyruk sınırı ayarla"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "vpnc uyumlu yapılandırma betiği kullanmak için kabuk komut satırı"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "öntanımlı"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr "Trafiği tun yerine 'betik' programından geçir"
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "Giriş kullanıcı adı ayarla"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "Sürüm numarasını raporla"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "Daha fazla çıktı"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr "HTTP kimlik doğrulama trafiğini dök (--verbose ayrıntılı"
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML yapılandırma dosyası"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "Kimlik doğrulama giriş seçimini seç"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "Sadece kimlik doğrula ve giriş bilgisini yazdır"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "Sadece webvpn çerezini getir; bağlanma"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "Bağlanmadan önce webvpn çerezini yazdır"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "Sunucu doğrulama için sertifika dosyası"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "IPv6 bağlantısı isteme"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "DTLS desteği için OpenSSL şifreleri"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "DTLS devre dışı bırak"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "HTTP bağlantısı yeniden-kullanımı devre dışı bırak"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "Parola/SecurID kimlik doğrulamasını devre dışı bırak"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "Geçerli olması için SSL sertifikasına ihtiyaç yok"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr "Öntanımlı sistem sertifika yetkilileri kapatıldı"
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr "XML POST kimlik doğrulaması girişimi yok"
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "Kullanıcı girdisi bekleme; gerekirse çık"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "Standart girdiden parola oku"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr "Yazılım jeton türü: rsa, totp ya da hotp"
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr "Yazılım jeton sırrı"
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr "(NOT: Bu derlemede libstoken (RSA SecurID) devre dışı bırakıldı)"
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr "(NOT: Bu derlemede Yubikey OATH devre dışı bırakıldı)"
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "Bağlantı yeniden deneme zaman aşımının saniye cinsinden değeri"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "Sunucunun sertifika SHA1 parmakizi"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP başlığı User-Agent: alan"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr "Bildirilecek işletim sistemi (linux, linux-64,win,...) türü"
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "DTLS veri birimi için yerel bağlantı noktası ayarla"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr "Karakter dizisi ayırma başarısız\n"
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "Yapılandırma dosyasından satır alma başarısız: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "%d satırında tanınmayan seçenek: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "'%s' seçeneği %d satırında bağımsız değişken almaz\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "'%s' seçeneği %d satırında bir değişken ister\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2357,7 +2397,7 @@ msgstr ""
 "görünüyorsunuz.\n"
 "         Garip davranışlara hazır olun.\n"
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2366,42 +2406,42 @@ msgstr ""
 "UYARI: Openconnect sürümü %s fakat\n"
 "         libopenconnect kütüphanesi %s'dir\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "Vpninfo yapısı ayrılırken başarısız olundu\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "Yapılandırma dosyası içindeki 'yapılandırma' seçeneği kullanılamıyor\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "Yapılandırma dosyası '%s' açılamıyor: %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d çok küçük\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2412,125 +2452,132 @@ msgstr ""
 "Eğer bu yardımcı olursa, lütfen <openconnect-devel@lists.infradead.org> "
 "adresine eposta atın.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "Kuyruk uzunluğu olarak sıfıra izin verilmiyor; 1 kullanılacak\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect sürümü %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr "Geçersiz yazılım jeton kipi \"%s\"\n"
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr "Geçersiz OS kimliği \"%s\"\n"
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "Komut satırında çok fazla değişken\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "Sunucu belirtilmemiş\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "Openconnect'in bu sürümü libproxy desteği olmadan derlendi\n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr "cmd yolu açılırken hata\n"
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "WebVPN çerezi alma işlemi başarısız oldu\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "SSL bağlantısı oluşturma işlemi başarısız oldu\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "DTLS ayarlama başarısız oldu; yerine SSL kullanarak\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "Hiçbir --script değişkeni verilmemiş; DNS ve yönlendirme yapılandırılmamış\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "http://www.infradead.org/openconnect/vpnc-script.html adresine bakın\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "'%s' yazmak için açılamadı: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "Arkaplanda devam ediyor; pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr "Kullanıcı yeniden bağlantı istedi\n"
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr "Yeniden bağlantı sırasında çerez reddedildi; çıkılıyor.\n"
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr "Oturum sunucu tarafından sonlandırıldı; çıkılıyor.\n"
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr "Kullanıcı iptal etti (SIGINT); çıkılıyor.\n"
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr "Kullanıcı oturumdan ayrıldı (SIGHUP); çıkılıyor.\n"
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr "Bilinmeyen hata; çıkılıyor.\n"
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "Yazmak için %s açılırken başarısız olundu: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "%s konumuna yapılandırma yazma başarısız: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "Sunucu SSL sertifikası uyuşmadı: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2541,91 +2588,102 @@ msgstr ""
 "\"%s\" VPN sunucusundan alınan sertifika doğrulanamadı.\n"
 "Neden: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 "Kabul etmek için '%s', iptal etmek için '%s'; görüntülemek için başka "
 "herhangi bir şey girin: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "hayır"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "evet"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr "Sunucu anahtar özeti: %s\n"
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr "Kimlik doğrulama seçeneği \"%s\" birden fazla seçenek ile eşleşiyor\n"
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "Kimlik doğrulama seçeneği \"%s\" kullanılabilir değil\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "Etkileşimli olmayan kipte kullanıcı girdisi istedi\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr "Yazmak için jeton dosyası açma başarısız oldu: %s\n"
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr "Jetona yazma başarısız: %s\n"
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr "Yazılım jeton katarı geçersiz\n"
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr "~/.stokenrc dosyası açılamıyor\n"
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr "OpenConnect libstoken desteğiyle derlendi\n"
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr "Genel libstoken eksikliği\n"
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr "OpenConnect liboath desteğiyle derlendi\n"
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr "Genel liboath eksikliği\n"
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr "Yubikey jetonu bulunamadı\n"
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr "OpenConnect Yubikey desteğiyle derlendi\n"
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr "Genel Yubikey hatası: %s\n"
@@ -2640,16 +2698,16 @@ msgstr "tun aygıtı ayarlama başarısız oldu\n"
 msgid "Set up tun device failed\n"
 msgstr "tun aygıtı ayarlama başarısız oldu\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr "Arayan bağlantısı durduruldu\n"
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "Yapılacak iş yok; %d ms'dir bekliyor...\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr "WaitForMultipleObjects başarısız oldu: %s\n"
@@ -2715,7 +2773,7 @@ msgstr "Sunucu yazılım jetonunu reddediyor; manuel giriş için değiştiriliy
 msgid "Generating OATH TOTP token code\n"
 msgstr "OATH TOTP jeton kodu oluşturuluyor\n"
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr "OATH HOTP jeton kodu oluşturuluyor\n"
 
@@ -2847,505 +2905,621 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr "HATA: %s() '%s' değişkeni için geçersiz UTF-8 ile çağrıldı\n"
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "DTLSv1 oturumu başlatma başarısız\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "DTLSv1 CTX başlatma başarısız\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "DTLS şifre listesi ayarlama başarısız\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "Tam bir DTLS şifresi değil\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"Eski protokol sürümü 0x%x ile SSL_set_session() başarısız oldu\n"
+"OpenSSL'in 0.9.8m'den daha eski bir sürümünü mü kullanıyorsunuz?\n"
+"http://rt.openssl.org/Ticket/Display.html?id=1751 adresine bakın\n"
+"Bu iletiyi engellemek için --no-dtls komut satırı seçeneğini kullan\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr "DTLS bağlantısı sağlandı (OpenSSL kullanarak). Ciphersuite %s.\n"
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"OpenSSL'iniz derlediklerinizden daha eski, bu yüzden DTLS hata alabilir!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+"Bu muhtemelen OpenSSL'inizin bozulmasından dolayıdır\n"
+"http://rt.openssl.org/Ticket/Display.html?id=2984 adresine bakın\n"
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS elsıkışması başarısız oldu: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr "libp11 PKCS#11 bağlamı sağlama başarısız oldu:\n"
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr "PKCS#11 sağlayıcı modül yüklemesi başarısız (%s):\n"
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr "PIN kilitlendi\n"
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr "PIN süresi doldu\n"
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr "Başka kullanıcı zaten giriş yapmış\n"
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr "PKCS#11 belirteci için bilinmeyen hata günlüğü\n"
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr "PKCS#11 '%s' yuvasına giriş yapıldı\n"
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr "PKCS#11 '%s' yuvasındaki sertifikaların sıralaması başarısız\n"
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr "%d yuvasında '%s' sertifika bulundu\n"
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr "PKCS#11 URI '%s' ayrıştırma başarısız oldu\n"
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr "PKCS#11 yuvaları numaralandırma işlemi başarısız\n"
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr "PKCS#11 '%s' yuvasına giriş yapılıyor\n"
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr "X.509 sertifika içeriği libp11 ile getirilemedi\n"
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr "OpenSSL bağlamında sertifika yükleme başarısız oldu\n"
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr "PKCS#11 '%s' yuvasındaki anahtarların sıralaması başarısız\n"
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr "%d yuvasında '%s' anahtarları bulundu\n"
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr "PKCS#11'den özel anahtar örnekleme başarısız\n"
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr "PKCS#11'den anahtar ekleme başarısız oldu\n"
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr "OpenConnect'in bu sürümü PKCS#11 desteği olmadan derlendi\n"
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "SSL sokete yazma işlemi başarısız oldu\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "SSL soketten okuma işlemi başarısız oldu\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "SSL okuma hatası %d (sunucu muhtemelen bağlantıyı kapattı); yeniden "
 "bağlanılıyor.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write başarısız oldu: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr "İşlenmeyen SSL UI istek türü %d\n"
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM parolası çok uzun (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "%s'den fazladan sertifika: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "PKCS#12 ayrıştırma başarısız oldu (yukarıdaki hataları bakın)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 sertifika içermiyor!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 hiçbir özel anahtar içermiyor!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr "PKCS#12"
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "TPM motoru yüklenemiyor.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "TPM motoru başlatma işlemi başarısız oldu\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "TPM SRK parolası ayarlama işlemi başarısız oldu\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "TPM özel anahtar yükleme işlemi başarısız oldu\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "TPM'den anahtar ekleme başarısız oldu\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "%s sertifika dosyası açma işlemi başarısız oldu: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "Sertifika yükleme başarısız oldu\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 "Desteklenen tüm sertifikaların işlenmesi başarısız oldu. Yine de "
 "deneniyor...\n"
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr "PEM dosyası"
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "Anahtar depo ögesi '%s' için BIO oluşturma başarısız oldu\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "Özel anahtar yükleme başarısız oldu (hatalı anahtar parolası mı?)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "Özel anahtar yükleme başarısız oldu (yukarıdaki hatalara bakın)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "Anahtar deposundan X509 sertifika yükleme işlemi başarısız\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "Anahtar deposundan X509 sertifikası kullanma başarısız oldu\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "Anahtar deposundan özel anahtar kullanma başarısız\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "%s özel anahtarı açma başarısız: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr "Özel anahtar yükleme başarısız\n"
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "'%s' konumunda özel anahtar türü tanımlama başarısız\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "Eşleşmiş DNS diğer ismi '%s'\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "Diğer isim '%s' için eşleşme yok\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr "Sertifika %d sahte uzunluklu GEN_IPADD diğer adına sahip\n"
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "%s adresi '%s' ile eşleşti\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "%s adresi ile '%s' için eşleşme yok\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' boş olmayan yola sahip; yoksayılıyor\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "Eşleşen URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "URI '%s' için eşleşme yok\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr "Uç sertifikasında '%s' ile eşleşen diğer bir isim yok\n"
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr "Uç sertifikada başlık adı yok!\n"
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr "Eş sertifikada başlık adı ayrıştırma başarısız\n"
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr "Uç sertifika başlığı eşleşmiyor ('%s' != '%s')\n"
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr "Eşleşmiş uç sertifika başlık adı '%s'\n"
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "cafile'dan yedek sertifika: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "İstemci sertifikasında notAfter alan hatası\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<error>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "'%s' CA dosyasından sertifikaları okuma başarısız\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "CA dosyası '%s' açma başarısız oldu\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL bağlantı hatası\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr "\"%s\" dahil kötü bölmeyi çıkar\n"
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr "\"%s\" hariç kötü bölmeyi çıkar\n"
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr "%s için '%s' betiği oluşturma başarısız: %s\n"
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr "'%s' betiğinden anormal çıkıldı (%x)\n"
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr "Betik '%s' %d hatasını döndü\n"
@@ -3644,85 +3818,97 @@ msgstr "Geçersiz PIN biçemi; tekrar deneyin.\n"
 msgid "Generating RSA token code\n"
 msgstr "RSA belirteç kodu oluşturuluyor\n"
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr "Ağ bağdaştırıcıları için kayıt yeri anahtarı erişim hatası\n"
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr "Eşleşmeyen TAP arayüzü \"%s\" yok sayılıyor\n"
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr "Windows-TAP bağdaştırıcısı bulunamadı. Sürücü kurulu mu?\n"
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr "%s açılamadı\n"
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr "Tun aygıtı %s açıldı\n"
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr "TAP sürücü sürümü alınamadı: %s\n"
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 "Hata: TAP-Windows sürücüsü için v9.9 ya da daha büyük sürüm gerekli (bulunan "
 "sürüm %ld.%ld)\n"
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr "TAP IP adresleri ayarlanamadı: %s\n"
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr "TAP ortam durumu ayarlama başarısız: %s\n"
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr "TAP aygıtı bağlantıyı durdurdu. Bağlantı kesiliyor.\n"
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr "TAP aygıtından okuma başarısız: %s\n"
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr "TAP aygıtından okuma işlemi tamamlanamadı: %s\n"
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr "%ld bayt tun'a yazıldı\n"
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr "Tun yazma için bekleniyor...\n"
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr "Bekleme sonrası tun için %ld bayt yazıldı\n"
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr "TAP aygıtına yazılamadı: %s\n"
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr "Tünel betiği oluşturma henüz Windows için desteklenmiyor\n"
 
diff --git a/po/tr_TR.po b/po/tr_TR.po
index 580b6794..7634e26c 100644
--- a/po/tr_TR.po
+++ b/po/tr_TR.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Turkish (Turkey) (http://www.transifex.com/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ug.po b/po/ug.po
index 6eb4b528..86945eb3 100644
--- a/po/ug.po
+++ b/po/ug.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-11-15 08:31+0000\n"
 "Last-Translator: Abduqadir Abliz <sahran.ug@gmail.com>\n"
 "Language-Team: Uighur (http://www.transifex.com/projects/p/meego/language/"
@@ -172,7 +172,7 @@ msgstr "ئىم سورالدى ئەمما '--no-passwd' تەڭشەلگەن\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "%s غىچە HTTPS باغلىنىشىنى ئاچالمىدى\n"
@@ -306,546 +306,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr "TCP_MAXSEG %d\n"
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "HTTPS ئىنكاسىغا ئېرىشىشتە خاتالىق كۆرۈلدى\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN مۇلازىمىتىنى ئىشلەتكىلى بولمايدۇ؛ سەۋەبى: %s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "خاتا HTTP CONNECT ئىنكاسىغا ئېرىشتى: %s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "CONNECT ئىنكاسىغا ئېرىشتى: %s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "تاللانمىلار ئۈچۈن ئەسلەك يوق\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr "X-DTLS-Session-ID بولسا 64 ھەرپ ئەمەس؛ بۇ: \"%s\"\n"
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "يوچۇن CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr "ھېچقانداق MTU قوبۇللىمىدى. چېكىنىۋاتىدۇ\n"
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "ھېچقانداق IP ئادرېس قوبۇللىمىدى. چېكىنىۋاتىدۇ\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "قايتا باغلىنىش پەرقلىق كونا IP ئادرېس بەردى  (%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "قايتا باغلىنىش پەرقلىق كونا IP تور ماسكىسى بەردى  (%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "قايتا باغلىنىش پەرقلىق IPv6 ئادرېس بەردى  (%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "قايتا باغلىنىش پەرقلىق IPv6 تور ماسكىسى بەردى  (%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP باغلاندى. DPD %d, Keepalive %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "پىرىسلاشنى تەڭشىيەلمىدى\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "كىچىكلىتىلگەن يىغلەكنى تەقسىملىيەلمىدى\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "كىچىكلىتەلمىدى\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr "%d كىچىكلىتەلمىدى\n"
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "بوغچا ئۇزۇنلۇقى توغرا ئەمەس. SSL_read %d نى قايتۇردى ئەمما بوغچا \n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "CSTP DPD ئىلتىماسىغا ئېرىشتى\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "CSTP DPD ئىنكاسىغا ئېرىشتى\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "CSTP Keepalive غا ئېرىشتى\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "%d بايتلىق پىرىسلانمىغان سانلىق مەلۇمات بوغچىسى تاپشۇرۇۋالدى\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "مۇلازىمېتىر ئۈزۈلۈشىنى تاپشۇرۇۋالدى: %02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "!deflate ھالەتتە پىرىسلانغان بوغچا تاپشۇرۇۋالدى\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "مۇلازىمېتىر ئاخىرلاشتۇرۇش بوغچىسىنى تاپشۇرۇۋالدى\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "يوچۇن بوغچا %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL يازغان بايت سانى بەك ئاز! ئىلتىماس قىلغىنى %d، يوللىغىنى %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr "CSTP ئاچقۇچ يېڭىلاش سەۋەبى\n"
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "قايتا باغلىنالمىدى\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "CSTP DPD يوللا\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "CSTP Keepalive يوللا\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr "%d بايتلىق پىرىسلانمىغان سانلىق مەلۇمات بوغچىسى يوللاۋاتىدۇ\n"
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr "يوللىغان BYE بوغچا: %s\n"
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr "DTLSv1 سۆزلىشىشنى دەسلەپلەشتۈرەلمىدى\n"
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr "DTLSv1 CTX نى دەسلەپلەشتۈرەلمىدى\n"
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr "DTLS شىفىر تىزىمىنى تەڭشىيەلمىدى\n"
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr "دەل بىر DTLS شىفىر ئەمەس\n"
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-"كونا كېلىشىم نەشرى 0x%x دا SSL_set_session() مەغلۇپ بولدى\n"
-"OpenSSL نىڭ 0.9.8m دىن كونا نەشرىنى ئىشلىتەمسىز؟\n"
-"http://rt.openssl.org/Ticket/Display.html?id=1751 نى كۆرۈڭ\n"
-"--no-dtls بۇيرۇق قۇرى تاللانمىسى ئىشلىتىلسە بۇ ئۇچۇردىن ساقلانغىلى بولىدۇ\n"
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-"OpenSSL سىزنىڭ نەشرىڭىزدىن كونا ئىكەن، شۇڭلاشقا DTLS مەغلۇپ بولۇشى مۇمكىن!"
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS قول ئېلىشىش ۋاقىت ھالقىدى\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS قول ئېلىشالمىدى: %d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr "ئىلتىماس قىلىنغان شىفىر يۈرۈشلۈكى '%s' نىڭ يوچۇن DTLS پارامېتىرلىرى\n"
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr "DTLS ئالدىنلىقىنى تەڭشىيەلمىدى: %s\n"
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr "DTLS سۆزلىشىش پارامېتىرلىرىنى تەڭشىيەلمىدى: %s\n"
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr "DTLS MTU نى تەڭشىيەلمىدى: %s\n"
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr "DTLS قول ئېلىشالمىدى: %s\n"
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr "DTLS ئادرېس يوق\n"
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr "مۇلازىمېتىر DTLS شىفىر تاللانمىسى تەمىنلىمىگەن\n"
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr "ۋاكالەتچى بىلەن باغلانغاندا DTLS يوق\n"
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS تاللانما %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "يېڭى DTLS باغلىنىشىنى سىناۋاتىدۇ\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr "DTLS بوغچىسى 0x%02x نى تاپشۇرۇۋالدى %d بايت\n"
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "DTLS DPD ئىلتىماسىغا ئېرىشتى\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr "DPD ئىنكاسىنى يوللىيالمىدى. ئۈزۈلۈشى مۇمكىن\n"
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "DTLS DPD ئىنكاسىغا ئېرىشتى\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr "DTLS Keepalive غا ئېرىشتى\n"
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr "يوچۇن DTLS بوغچا تىپى %02x، ئۇزۇنلۇقى %d\n"
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr "DTLS ئاچقۇچ يېڭىلاش سەۋەبى\n"
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "DTLS DPD يوللا\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr "DPD ئىلتىماسىنى يوللىيالمىدى. ئۈزۈلۈشى مۇمكىن\n"
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr "DTLS Keepalive يوللا\n"
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr "keepalive ئىلتىماسىنى يوللىيالمىدى. ئۈزۈلۈشى مۇمكىن\n"
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr "يوچۇن بوغچا (len %d) تاپشۇرۇۋالدى: %02x %02x %02x %02x...\n"
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr "DTLS يېزىش خاتالىقى %d غا ئېرىشتى. SSL گە قايتىدۇ\n"
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr "DTLS يېزىش خاتالىقى %s غا ئېرىشتى. SSL گە قايتىدۇ\n"
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr "%d بايتلىق DTLS بوغچىسى يوللىدى؛ DTLS يوللاش %d قايتۇردى\n"
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgstr ""
+
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -947,6 +881,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr "ئىلتىماس قىلىنغان شىفىر يۈرۈشلۈكى '%s' نىڭ يوچۇن DTLS پارامېتىرلىرى\n"
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr "DTLS ئالدىنلىقىنى تەڭشىيەلمىدى: %s\n"
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr "DTLS سۆزلىشىش پارامېتىرلىرىنى تەڭشىيەلمىدى: %s\n"
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr "DTLS MTU نى تەڭشىيەلمىدى: %s\n"
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS قول ئېلىشىش ۋاقىت ھالقىدى\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr "DTLS قول ئېلىشالمىدى: %s\n"
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -967,7 +992,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -986,7 +1011,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr "SSL يېزىشتىن ۋاز كەچتى\n"
 
@@ -995,493 +1020,497 @@ msgstr "SSL يېزىشتىن ۋاز كەچتى\n"
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "SSL socket نى يازالمىدى: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr "SSL ئوقۇشتىن ۋاز كەچتى\n"
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "SSL socket تىن ئوقۇيالمىدى: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr "SSL ئوقۇش خاتالىقى: %s؛ قايتا باغلىنىۋاتىدۇ.\n"
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr "SSL يوللىيالمىدى: %s\n"
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "گۇۋاھنامىنىڭ توشىدىغان قەرەلىنى ئوقۇيالمىدى\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr "خېرىدار گۇۋاھنامىسىنىڭ قەرەلى ئۆتىدىغان ۋاقىت"
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr "خېرىدار گۇۋاھنامىسىنىڭ قەرەلى توشىدىغان ۋاقىت"
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr "ئاچقۇچ ئامبىرىدىن '%s' تۈرنى يۈكلىيەلمىدى: %s\n"
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr "ئاچقۇچ/گۇۋاھنامە ھۆججىتى %s نى ئاچالمىدى: %s\n"
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr "ئاچقۇچ/گۇۋاھنامە ھۆججىتى %s نى سىتاتىستىكا قىلالمىدى: %s\n"
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "گۇۋاھنامە يىغلەكنى تەقسىملىيەلمىدى\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "گۇۋاھنامىنى ئەسلەككە ئوقۇيالمىدى: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "PKCS#12 سانلىق مەلۇمات قۇرۇلمىسىنى تەڭشىيەلمىدى: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr "PKCS#12 گۇۋاھنامە ھۆججەت شىفىرىنى يېشەلمىدى\n"
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr "PKCS#12 ئىم جۈملىسى كىرگۈزۈڭ:"
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "PKCS#12 ھۆججەتنى بىر تەرەپ قىلالمىدى: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "PKCS#12 ھۆججەتنى يۈكلىيەلمىدى: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "X509 گۇۋاھنامىنى ئەكىرەلمىدى: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "PKCS#11 گۇۋاھنامىنى تەڭشىيەلمىدى: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr "MD5 hash نى دەسلەپلەشتۈرەلمىدى: %s\n"
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr "MD5 hash خاتالىقى: %s\n"
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr "PEM شىفىرلاش تىپىنى جەزملىيەلمىدى\n"
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr "قوللىمايدىغان PEM شىفىرلاش تىپى: %s\n"
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr "base64 كود يەشكۈچتە PEM ھۆججەتنى شىېفىرلىغاندا خاتالىق كۆرۈلدى: %s\n"
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr "شىفىرلانغان PEM ھۆججەت بەك قىسقا\n"
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr "PEM ھۆججەت شىفىرىنى يېشىش ئۈچۈن شىفىرنى دەسلەپلەشتۈرەلمىدى: %s\n"
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr "PEM ئاچقۇچ شىفىرىنى يېشەلمىدى: %s\n"
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr "PEM ئاچقۇچ شىفىرىنى يېشەلمىدى\n"
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr "PEM ئىم جۈملىسى كىرگۈزۈڭ:"
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr "بۇ ئىككىلىك نەشرى PKCS#11 نى قوللىمايدۇ\n"
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "PKCS#11 گۇۋاھنامە %s ئىشلىتىدۇ\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "PKCS#11 دىن گۇۋاھنامە يۈكلىيەلمىدى: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr "گۇۋاھنامە ھۆججىتى %s نى ئىشلىتىۋاتىدۇ\n"
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "PKCS#11 ھۆججەتتە گۇۋاھنامە يوق\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "ھۆججەتتە گۇۋاھنامە يوق"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "گۇۋاھنامىنى يۈكلىيەلمىدى: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "شەخسىي ئاچقۇچ قۇرۇلمىسىنى دەسلەپلەشتۈرۈۋاتقاندا خاتالىق كۆرۈلدى: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr "PKCS#11 ئاچقۇچ قۇرۇلمىسىنى دەسلەپلەشتۈرۈۋاتقاندا خاتالىق كۆرۈلدى: %s\n"
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "PKCS#11 URL %s نى ئەكىرىۋاتقاندا خاتالىق كۆرۈلدى: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "PKCS#11 ئاچقۇچ %s ئىشلىتىدۇ\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 "PKCS#11 ئاچقۇچنى شەخسىي ئاچقۇچ قۇرۇلمىسىغا ئەكىرىۋاتقاندا خاتالىق كۆرۈلدى: "
 "%s\n"
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "شەخسىي ئاچقۇچ ھۆججەت %s نى ئىشلىتىدۇ\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr "بۇ OpenConnect نەشرى TPM نى قوللىمايدۇ\n"
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr "PEM ھۆججەتنى چۈشەندۈرەلمىدى\n"
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr "PKCS#1 شەخسىي ئاچقۇچنى يۈكلىيەلمىدى: %s\n"
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr "شەخسىي ئاچقۇچنى PKCS#8 سۈپىتىدە يۈكلىيەلمىدى: %s\n"
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr "PKCS#8 گۇۋاھنامە ھۆججەت شىفىرىنى يېشەلمىدى\n"
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr "شەخسىي ئاچقۇچ %s نىڭ تىپىنى جەزملىيەلمىدى\n"
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr "PKCS#8 ئىم جۈملىسى كىرگۈزۈڭ:"
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr "ئاچقۇچ ID غا ئېرىشەلمىدى: %s\n"
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 "شەخسىي ئاچقۇچ بىلەن سىناق سانلىق مەلۇماتتا تىزىمغا كىرىۋاتقاندا خاتالىق "
 "كۆرۈلدى: %s\n"
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 "گۇۋاھنامە ئىمزاسىغا نىسبەتەن دەلىللەش ئېلىپ بېرىۋاتقاندا خاتالىق كۆرۈلدى: "
 "%s\n"
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr "شەخسىي ئاچقۇچقا ماس كېلىدىغان ھېچقانداق SSL گۇۋاھنامە تېپىلمىدى\n"
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr "خېرىدار گۇۋاھنامىسى '%s' نى ئىشلىتىدۇ\n"
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr "گۇۋاھنامە كۈچتىن قېلىش تىزىمىنى تەڭشەۋاتقاندا خاتالىق كۆرۈلدى: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 "ئاگاھلاندۇرۇش: GnuTLS خاتا تارقىتىلغان گۇۋاھنامە قايتۇردى؛ دەلىللەش مەغلۇپ "
 "بولۇشى مۇمكىن!\n"
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr "قوللايدىغان گۇۋاھنامىلەر ئۈچۈن ئەسلەك تەقسىملىيەلمىدى\n"
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "قوللايدىغان CA '%s' قوشۇۋاتىدۇ\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "گۇۋاھنامىنى تەڭشىيەلمىدى: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "مۇلازىمېتىر تارقىتىدىغان گۇۋاھنامە يوق\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr "X509 گۇۋاھنامە قۇرۇلمىسىنى دەسلەپلەشتۈرەلمىدى\n"
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr "مۇلازىمېتىرنىڭ گۇۋاھنامىسىنى ئەكىرىۋاتقاندا خاتالىق كۆرۈلدى\n"
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "مۇلازىمېتىر گۇۋاھنامە ھالىتىنى تەكشۈرۈۋاتقاندا خاتالىق كۆرۈلدى\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "گۇۋاھنامە كۈچتىن قالدى"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "ئىمزا قويغۇچى تېپىلمىدى"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr "ئىمزا قويغۇچى بىر CA گۇۋاھنامىسى ئەمەس"
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr "بىخەتەر بولمىغان ھېسابلاش ئۇسۇلى"
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr "گۇۋاھنامە تېخى ئاكتىپلانمىغان"
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "گۇۋاھنامىنىڭ ۋاقتى ئۆتكەن"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr "ئىمزا دەلىللىيەلمىدى"
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr "گۇۋاھنامە ماشىنا ئاتىغا ماس كەلمىدى"
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr "مۇلازىمېتىر گۇۋاھنامىسىنى دەلىللىيەلمىدى: %s\n"
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr "CA ھۆججەت گۇۋاھنامىسى ئۈچۈن ئەسلەك تەقسىملىيەلمىدى\n"
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr "CA ھۆججەتتىن گۇۋاھنامە ئوقۇيالمىدى: %s\n"
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr "CA ھۆججەت  '%s' تىن گۇۋاھنامە ئاچالمىدى: %s\n"
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr "گۇۋاھنامىنى يۈكلىيەلمىدى. چېكىنىۋاتىدۇ.\n"
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr "%s بىلەن SSL كېڭىشى\n"
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "SSL باغلىنىشتىن ۋاز كەچتى\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr "SSL باغلىنالمىدى: %s\n"
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr "قول ئېلىشىۋاتقاندا GnuTLS ئەجەللىك بولمىغان قايتۇرۇش: %s\n"
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr "%s دا HTTPS غا باغلاندى\n"
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr "%s ئۈچۈن PIN زۆرۈر"
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "PIN خاتا"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "بۇ قۇلۇپلاشتىن ئىلگىرىكى ئاخىرقى سىناق!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr "قۇلۇپلاشتىن ئىلگىرى بىر قانچە قېتىملىق سىناقلا قالدى!"
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "PIN نى كىرگۈزۈڭ"
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1675,7 +1704,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1693,238 +1722,238 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr "cookies تەقسىملەيدىغان ئەسلەك يوق\n"
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr "HTTP ئىنكاسى '%s' نى تەھلىل قىلالمىدى\n"
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "HTTP ئىنكاسىغا ئېرىشتى: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "HTTPS ئىنكاسىنى بىر تەرەپ قىلىۋاتقاندا خاتالىق كۆرۈلدى\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr "يوچۇن HTTP ئىنكاس قۇرى '%s' غا پەرۋا قىلمايۋاتىدۇ\n"
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "ئىناۋەتسىز cookie تەمىنلىگەن: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr "SSL گۇۋاھنامە دەلىللىيەلمىدى\n"
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr "ئىنكاس گەۋدىسى مەنپىي چوڭلۇقتا (%d)\n"
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr "يوچۇن يوللاش كودلىنىشى: %s\n"
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr "HTTP گەۋدىسى %s (%d)\n"
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr "HTTP ئىنكاس گەۋدىسىنى ئوقۇش خاتالىقى\n"
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr "بۆلەك بېشىغا ئېرىشىش خاتالىقى\n"
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 "ۋاكالەتچى ئىنكاسىغا ئېرىشىشتە خاتالىق كۆرۈلدىHTTP ئىنكاس گەۋدىسىگە ئېرىشىش "
 "خاتالىقى\n"
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr "بۆلەك كۆد يېشىش خاتالىقى. مۆلچەرلىگىنى ''، ئېرىشكىنى: '%s'"
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr "باشلىنىش يېپىلمىغان HTTP 1.0 گەۋدىسىنى قوبۇل قىلالمايدۇ\n"
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr "قايتا نىشانلايدىغان URL '%s' نى تەھلىل قىلالمىدى: %s\n"
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr "قايتا نىشانلايدىغان https ئەمەس URL '%s' غا ئەگىشەلمىدى\n"
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr "مۇناسىۋەتلىك قايتا نىشانلاش ئۈچۈن يېڭى يولنى تەقسىملىيەلمىدى: %s\n"
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr "مۇلازىمېتىرنىڭ ئويلىشىلمىغان %d نەتىجىسى\n"
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr "ئىجازەت ئىلتىماسى"
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "ئادەتتىكى مەغلۇبىيەت"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "قائىدە توپلىمى باغلىنىشقا يول قويمىدى"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "تورغا يېتەلمەيدۇ"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "ماشىنىغا يېتەلمەيدۇ"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "نىشان ماشىنا باغلىنىشنى رەت قىلدى"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL ۋاقتى ئۆتتى"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "بۇيرۇقنى قوللىمايدۇ/كېلىشىم خاتالىقى"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "ئادرېس تىپىنى قوللىمايدۇ"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr "دەلىللەش ئىلتىماسىنى SOCKS ۋاكالەتچىگە يېزىش خاتالىقى: %s\n"
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr "دەلىللەش ئىنكاسىنى SOCKS ۋاكالەتچىدىن ئوقۇش خاتالىقى: %s\n"
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr "SOCKS ۋاكالەتچىنىڭ ئويلاشمىغان دەلىللەش ئىنكاسى: %02x %02x\n"
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr "%s غا SOCKS ۋاكالەتچى باغلىنىش ئىلتىماسى: %d\n"
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 "باغلىنىش ئىلتىماسىنى SOCKS ۋاكالەتچىگە يېزىۋاتقاندا خاتالىق كۆرۈلدى: %s\n"
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr "باغلىنىش ئىنكاسىنى SOCKS ۋاكالەتچىدىن ئوقۇش خاتالىقى: %s\n"
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr "SOCKS ۋاكالەتچىدىن كەلگەن ئويلاشمىغان باغلىنىش ئىنكاسى: %02x %02x...\n"
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr "SOCKS ۋاكالەتچى خاتالىقى %02x: %s\n"
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr "SOCKS ۋاكالەتچى خاتالىقى %02x\n"
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr "SOCKS باغلىنىش ئىنكاسىدىكى ئويلاشمىغان ئادرېس تىپى %02x\n"
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr "%s غا HTTP ۋاكالەتچى باغلىنىش ئىلتىماسى: %d\n"
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr "ۋاكالەتچى ئىلتىماسىنى يوللىيالمىدى: %s\n"
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr "ۋاكالەتچى CONNECT ئىلتىماسى مەغلۇپ بولدى: %d\n"
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr "يوچۇن ۋاكالەتچى خاتالىقى '%s'\n"
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr "پەقەت http ياكى socks(5) نىلا قوللايدۇ\n"
 
@@ -1937,45 +1966,62 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr "ئىچكى SSL ئامبار نەشرىدە Cisco DTLS نى قوللىمايدۇ\n"
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr "مۇلازىمېتىر URL '%s' نى تەھلىل قىلالمىدى\n"
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr "مۇلازىمېتىر URL پەقەت https:// غىلا يول قويىدۇ\n"
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr "كۆزنەك بىر تەرەپ قىلغۇچ يوق؛ دەلىللىيەلمەيدۇ\n"
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr "stdin دىن ھەرپ تىزىقىنى تەقسىملىيەلمىدى\n"
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
@@ -1984,25 +2030,21 @@ msgstr ""
 "OpenConnect ھەققىدىكى ياردەمنى تۆۋەندىكى تورتۇرادىن كۆرۈڭ\n"
 "http://www.infradead.org/openconnect/mail.html\n"
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr "OpenSSL. ئىشلىتىش ئىقتىدار تونۇشتۇرۇش:"
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr "GnuTLS. ئىشلىتىش ئىقتىدار تونۇشتۇرۇش:"
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr "OpenSSL موتورى مەۋجۇت ئەمەس"
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr "OpenSSL ئىشلەت"
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
@@ -2012,31 +2054,31 @@ msgstr ""
 "ئاگاھلاندۇرۇش: بۇ ئىككىلىك ھالەتتە DTLS نى قوللىمايدۇ. ئۈنۈمى تەسىرگە "
 "ئۇچرىشى مۇمكىن.\n"
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr "fgets (stdin)"
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr "ئىشلىتىلىشى: openconnect [options] <server>\n"
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
@@ -2045,306 +2087,306 @@ msgstr ""
 "Cisco AnyConnect VPN ئوچۇق خېرىدارى، نەشرى %s\n"
 "\n"
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr "سەپلىمە ھۆججەتتىن تاللانمىلارنى ئوقۇ"
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr "قوزغالغاندىن كېيىن ئارقا سۇپىدا داۋاملاشتۇر"
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr "نازارەتچىنىڭ PID نى بۇ ھۆججەتكە ياز"
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr "SSL خېرىدار گۇۋاھنامىسى CERT نى ئىشلەت"
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr "گۇۋاھنامىنىڭ ئىناۋەتلىك ۋاقتىنى ئاگاھلاندۇر < DAYS"
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr "SSL شەخسىي ئاچقۇچ ھۆججەت ئاچقۇچىنى ئىشلەت"
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr "WebVPN cookie COOKIE ئىشلەت"
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr "ئۆلچەملىك كىرگۈزۈشتىن cookie ئوقۇ"
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "پىرىسلاشنى قوزغات (كۆڭۈلدىكى)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "پىرىسلاشنى چەكلە"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "usergroup تىزىمغا كىرىش تەڭشىكى"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "ياردەم مەتىننى كۆرسەت"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr "تونىل ئېغىزى ئۈچۈن IFNAME ئىشلەت"
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr "سۈرئەت ئۇچۇرى ئۈچۈن syslog ئىشلەت"
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr "باغلانغاندىن كېيىن ئالدىنلىقنى تاشلا"
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr "CSD نى ئىجرا قىلىش جەريانىدا ئالدىنلىقنى تاشلا"
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr "CSD ئىككىلىكنىڭ ئورنىغا SCRIPT ئىجرا قىل"
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr "مۇلازىمېتىرغا/دىن MTU يولىنى كۆرسەت"
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr "ئاچقۇچ ئىم جۈملىسى ياكى TPM SRK PIN تەڭشىكى"
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr "ھۆججەت سىستېمىسىنىڭ ھالقىلىق ئىم جۈملىسى fsid"
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "ۋاكالەتچى مۇلازىمېتىر تەڭشەك"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "ۋاكالەتچىنى چەكلە"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr "ئۆزلۈكىدىن سەپلىنىدىغان ۋاكالەتچى libproxy نى ئىشلەت"
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr "(دىققەت: libproxy بۇ نەشرىدە چەكلەنگەن)"
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "ئازراق چىقىرىش"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr "بوغچا قاتار چېكىنى LEN pkts غا تەڭشە"
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr "vpnc ماسلىشىشچان سەپلىمە قوليازمىسىنىڭ Shell بۇيرۇقى قۇرى"
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "كۆڭۈلدىكى"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "تىزىمغا كىرىدىغان ئىشلەتكۈچى ئاتى تەڭشىكى"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "دوكلات نەشر نومۇرى"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "تېخىمۇ كۆپ چىقىرىش"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML سەپلىمە ھۆججەت"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr "دەلىللەپ تىزىمغا كىرىش تاللانمىسىنى تاللاڭ"
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr "پەقەت دەلىللەش ۋە باسىدىغان تىزىمغا كىرىش ئۇچۇرى بار"
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr "webvpn cookie غىلا ئېرىش؛ باغلانما"
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr "باغلىنىشتىن ئىلگىرى webvpn cookie نى باس"
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr "مۇلازىمېتىر دەلىللەش ئۈچۈن گۇۋاھنامە ھۆججەت"
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr "IPv6 باغلىنىشىنى سورىما"
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr "DTLS نى قوللايدىغان OpenSSL شىفىر"
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr "DTLS نى چەكلە"
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr "HTTP باغلىنىشىنى قايتا ئىشلىتىشنى چەكلە"
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr "ئىم/SecurID دەلىللەشنى چەكلە"
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr "مۇلازىمېتىر SSL گۇۋاھنامىسى زۆرۈر بولماسلىق ئىناۋەتلىك"
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr "ئىشلەتكۈچى كىرگۈزۈشنى ئۈمىد قىلما؛ زۆرۈر بولسا چېكىن"
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr "ئۆلچەملىك كىرگۈزۈشتىن ئىم ئوقۇ"
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr "سېكۇنت بىلەن ئىپادىلەنگەن باغلىنىشنى قايتا سىناش مۆھلىتى"
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr "مۇلازىمېتىرنىڭ گۇۋاھنامە SHA1 بارماق ئىزى"
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr "HTTP بېشىنىڭ ئىشلەتكۈچى ۋاكالەتچىسى: سۆز بۆلىكى"
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr "DTLS سانلىق مەلۇمات بوغچىسىنىڭ يەرلىك ئېغىز تەڭشىكى"
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr "سەپلىمە ھۆججەتتىن قۇرغا ئېرىشەلمىدى: %s\n"
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr "%d قۇردىكى تونۇيالمايدىغان تاللانما: '%s'\n"
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr "'%s' تاللانما %d قۇردىكى ئۆزگەرگۈچىگە ئېرىشەلمىدى\n"
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr "'%s' تاللانما %d قۇردىكى ئۆزگەرگۈچىنى ئىلتىماس قىلدى\n"
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2352,7 +2394,7 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
@@ -2361,42 +2403,42 @@ msgstr ""
 "ئاگاھلاندۇرۇش: بۇ نەشرىدىكى openconnect بولسا %s ئەمما libopenconnect "
 "ئامبىرى %s\n"
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr "vpninfo قۇرۇلمىسىنى تەقسىملىيەلمىدى\n"
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr "سەپلىمە ھۆججەتتە 'config' تاللانمىسىنى ئىشلىتەلمەىدى\n"
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr "سەپلىمە ھۆججەت «%s»نى ئاچالمىدى: %s\n"
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr "MTU %d بەك كىچىك\n"
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
@@ -2407,125 +2449,132 @@ msgstr ""
 "ئەگەر بۇنىڭ ياردىمى بولسا <openconnect-devel@lists.infradead.org> غا دوكلات "
 "قىلىڭ.\n"
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr "قاتار ئۇزۇنلۇقىنىڭ نۆل بولۇشىغا يول قويۇلمايدۇ؛ 1 نى ئىشلىتىڭ\n"
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr "OpenConnect نەشرى %s\n"
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr "بۇيرۇق قۇرىدا ئۆزگەرگۈچى بەك كۆپ\n"
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr "مۇلازىمېتىر بەلگىلەنمىگەن\n"
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr "openconnect نىڭ بۇ نەشرى libproxy نى قوللىمايدۇ \n"
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr "WebVPN cookie غا ئېرىشەلمىدى\n"
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr "SSL باغلىنىشى قۇرالمىدى\n"
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr "DTLS نى تەڭشىيەلمىدى؛ ئورنىغا SSL ئىشلىتىڭ\n"
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 "ھېچقانداق --script ئۆزگەرگۈچى تەمىنلەنمىگەن؛ DNS ۋە يېتەكلىگۈچ سەپلەنمىگەن\n"
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr "http://www.infradead.org/openconnect/vpnc-script.html نى كۆرۈڭ\n"
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr "يېزىش ئۈچۈن «%s»نى ئاچالمىدى: %s\n"
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr "ئارقا سۇپىدا داۋاملاشتۇر؛ pid %d\n"
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr "يېزىش ئۈچۈن %s نى ئاچالمىدى: %s\n"
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr "سەپلىمىنى %s غا يازالمىدى: %s\n"
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr "مۇلازىمېتىر SSL گۇۋاھنامىسى ماسلاشمىدى: %s\n"
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2536,89 +2585,100 @@ msgstr ""
 "VPN مۇلازىمىتىر «%s» دىن گۇۋاھنامە دەلىللىيەلمىدى.\n"
 "سەۋەبى: %s\n"
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr "«%s» كىرگۈزۈلسە قوشۇلىدۇ، «%s» چېكىنىدۇ؛ ئۇنداق بولمىسا كۆرسىتىدۇ: "
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ياق"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "ھەئە"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "دەلىللەشكە «%s»نى تاللاپ ئىشلەتكىلى بولمايدۇ\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr "تەسىرلەشمەيدىغان ھالەتتە ئىشلەتكۈچى كىرگۈزۈشى زۆرۈر\n"
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2633,16 +2693,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr "tun ئۈسكۈنىسىنى تەڭشىيەلمىدى\n"
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr "ھېچقانداق ئىش يوق؛ %dms ئۇخلايدۇ…\n"
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2708,7 +2768,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2840,503 +2900,617 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr "DTLSv1 سۆزلىشىشنى دەسلەپلەشتۈرەلمىدى\n"
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr "DTLSv1 CTX نى دەسلەپلەشتۈرەلمىدى\n"
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr "DTLS شىفىر تىزىمىنى تەڭشىيەلمىدى\n"
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr "دەل بىر DTLS شىفىر ئەمەس\n"
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+"كونا كېلىشىم نەشرى 0x%x دا SSL_set_session() مەغلۇپ بولدى\n"
+"OpenSSL نىڭ 0.9.8m دىن كونا نەشرىنى ئىشلىتەمسىز؟\n"
+"http://rt.openssl.org/Ticket/Display.html?id=1751 نى كۆرۈڭ\n"
+"--no-dtls بۇيرۇق قۇرى تاللانمىسى ئىشلىتىلسە بۇ ئۇچۇردىن ساقلانغىلى بولىدۇ\n"
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+"OpenSSL سىزنىڭ نەشرىڭىزدىن كونا ئىكەن، شۇڭلاشقا DTLS مەغلۇپ بولۇشى مۇمكىن!"
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS قول ئېلىشالمىدى: %d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "SSL socket نى يازالمىدى\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr "SSL socket تىن ئوقۇيالمىدى\n"
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 "SSL ئوقۇش خاتالىقى %d (مۇلازىمېتىر باغلىنىشنى تاقىشى مۇمكىن)؛ قايتا "
 "باغلىنىۋاتىدۇ.\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write مەغلۇپ بولدى: %d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr "PEM ئىم جۈملىسى بەك ئۇزۇن (%d >= %d)\n"
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr "%s نىڭ زىيادە گۇۋاھنامىسى: '%s'\n"
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr "PKCS#12 نى تەھلىل قىلالمىدى (ئۈستىدىكى خاتالىقلارنى كۆرۈڭ)\n"
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr "PKCS#12 دا گۇۋاھنامە يوق!\n"
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr "PKCS#12 دا شەخسىي ئاچقۇچ يوق!\n"
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr "TPM موتۇرنى يۈكلىيەلمىدى.\n"
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr "TPM موتۇرنى دەسلەپلەشتۈرەلمىدى\n"
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr "TPM SRK ئىمنى تەڭشىيەلمىدى\n"
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr "TPM شەخسىي ئاچقۇچنى يۈكلىيەلمىدى\n"
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr "TPM دىن ئاچقۇچ قوشالمىدى\n"
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr "گۇۋاھنامە ھۆججىتى %s نى ئاچالمىدى: %s\n"
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr "گۇۋاھنامىنى يۈكلىيەلمىدى\n"
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr "ئاچقۇچ ئامبار تۈرى '%s' دىن BIO نى قۇرالمىدى\n"
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr "شەخسىي ئاچقۇچنى يۈكلىيەلمىدى (ئىم جۈملىسى خاتا؟)\n"
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr "شەخسىي ئاچقۇچنى يۈكلىيەلمىدى (ئۈستىدىكى خاتالىقلارنى كۆرۈڭ)\n"
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr "ئاچقۇچ ئامبىرىدىن X509 گۇۋاھنامىنى يۈكلىيەلمىدى\n"
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr "ئاچقۇچ ئامبىرىدىن X509 گۇۋاھنامىنى ئىشلىتەلمىدى\n"
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr "ئاچقۇچ ئامبىرىدىن شەخسىي ئاچقۇچنى ئىشلىتەلمىدى\n"
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr "شەخسىي ئاچقۇچ ھۆججىتى %s نى ئاچالمىدى: %s\n"
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr "شەخسىي ئاچقۇچ ھۆججىتى %s نى تونۇيالمىدى\n"
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr "DNS altname '%s' ماسلاشتى\n"
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr "altname '%s' ماس كېلىدىغىنى يوق\n"
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr "ماسلاشقىنى %s ئادرېس '%s'\n"
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr "'%s' ئۈچۈن ماس كېلىدىغىنى يوق ئادرېس '%s'\n"
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr "URI '%s' نىڭ بوش ئەمەس يولى بار؛ پەرۋا قىلمايۋاتىدۇ\n"
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr "ماس كەلگەن URI '%s'\n"
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr "URI '%s' ئۈچۈن ماس كەلگىنى يوق\n"
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr "cafile دىن زىيادە گۇۋاھنامە: '%s'\n"
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr "خېرىدار گۇۋاھنامەدىكى notAfter سۆز بۆلەك خاتالىقى\n"
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr "<خاتالىق>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr "CA ھۆججەت '%s' تىن گۇۋاھنامە ئوقۇش خاتالىقى\n"
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr "CA ھۆججەت '%s' تىن ئوقۇيالمىدى\n"
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL باغلىنالمىدى\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3633,83 +3807,95 @@ msgstr "ئىناۋەتسىز PIN پىچىمى، قايتا سىناڭ.\n"
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/uk.po b/po/uk.po
index 90945278..48142457 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-11-15 08:31+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Ukrainian (http://www.transifex.com/projects/p/meego/language/"
@@ -173,7 +173,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -300,541 +300,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -936,6 +875,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -956,7 +986,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -975,7 +1005,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -984,486 +1014,490 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr "Не вдалося виконати читання до сокета SSL: %s\n"
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr "Не вдалося виконати читання з сокета SSL: %s\n"
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr "Не вдалося видобути час завершення строку дії сертифіката\n"
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr "Не вдалося розмістити буфер сертифікатів\n"
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr "Не вдалося прочитати сертифікат до пам’яті: %s\n"
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr "Не вдалося налаштувати структуру даних PKCS#12: %s\n"
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr "Не вдалося обробити файл PKCS#12: %s\n"
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr "Не вдалося завантажити сертифікат PKCS#12: %s\n"
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr "Спроба імпортування сертифіката X509 зазнала невдачі: %s\n"
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr "Спроба встановлення сертифіката PKCS#11 зазнала невдачі: %s\n"
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr "Використовуємо сертифікат PKCS#11 %s\n"
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr "Помилка під час завантаження сертифіката з PKCS#11: %s\n"
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr "У файлі PKCS#11 не міститься сертифіката\n"
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr "У файлі не знайдено сертифіката"
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr "Спроба завантаження сертифіката зазнала невдачі: %s\n"
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr "Помилка під час спроби ініціалізувати структуру закритих ключів: %s\n"
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr "Помилка під час імпортування адреси PKCS#11 %s: %s\n"
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr "Використовуємо ключ PKCS#11 %s\n"
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr "Використовуємо файл закритого ключа %s\n"
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 "Спроба встановлення списку відкликаних сертифікатів зазнала невдачі: %s\n"
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr "Додавання підтримувального CA «%s»\n"
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr "Спроба встановлення сертифіката зазнала невдачі: %s\n"
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr "Сервером не надано сертифіката\n"
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr "Помилка під час спроби перевірити стан сертифіката сервера\n"
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr "сертифікат відкликано"
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr "підписувача не знайдено"
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr "строк дії сертифіката збіг"
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr "Спробу з’єднання SSL скасовано\n"
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr "Помилковий код"
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr "Це остання спроба перед блокуванням!"
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr "Вкажіть пінкод: "
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1657,7 +1691,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1675,235 +1709,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "Отримано відповідь HTTP: %s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr "Запропоновано некоректну куку: %s\n"
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "загальна помилка"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr "з’єднання заборонено набором правил"
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "мережа недоступна"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "вузол недоступний"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr "у з’єднанні відмовлено вузлом призначення"
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "Завершився строк дії TTL"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "команда не підтримується / помилка у протоколі"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "тип адреси не підтримується"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1916,407 +1950,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr "типовий"
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2324,173 +2371,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2498,89 +2552,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "ні"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "так"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2595,16 +2660,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2670,7 +2735,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2802,501 +2867,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr "Не вдалося виконати читання до сокета SSL\n"
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3593,83 +3767,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/ur_PK.po b/po/ur_PK.po
index fd8d6476..6b9755b9 100644
--- a/po/ur_PK.po
+++ b/po/ur_PK.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Urdu (Pakistan) (http://www.transifex.net/projects/p/meego/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/uz.po b/po/uz.po
index 262c13c8..ed757e50 100644
--- a/po/uz.po
+++ b/po/uz.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Uzbek (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/vi.po b/po/vi.po
index 7e4c959c..66102163 100644
--- a/po/vi.po
+++ b/po/vi.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-09-22 22:31+0000\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: Vietnamese (http://www.transifex.net/projects/p/meego/team/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/vi_VN.po b/po/vi_VN.po
index 3ed7daf8..5a8fbd7f 100644
--- a/po/vi_VN.po
+++ b/po/vi_VN.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-21 09:22+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Vietnamese (Viet Nam) (http://www.transifex.net/projects/p/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/wa.po b/po/wa.po
index baa0570d..dace3d5e 100644
--- a/po/wa.po
+++ b/po/wa.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-06-20 08:43+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Walloon <linux-wa@walon.org>\n"
@@ -170,7 +170,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -297,541 +297,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -933,6 +872,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -953,7 +983,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -972,7 +1002,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -981,485 +1011,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1653,7 +1687,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1671,235 +1705,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1912,407 +1946,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2320,173 +2367,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2494,89 +2548,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2591,16 +2656,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2666,7 +2731,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2798,501 +2863,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3589,83 +3763,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/xh.po b/po/xh.po
index d95e520f..875e995d 100644
--- a/po/xh.po
+++ b/po/xh.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Xhosa (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 74fb858e..b3adb7b9 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-11-15 08:31+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Chinese (China) (http://www.transifex.com/projects/p/meego/"
@@ -173,7 +173,7 @@ msgstr "请求密码，但设置了“--no-password”\n"
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr "打开到 %s 的 HTTPS 连接失败\n"
@@ -300,541 +300,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr "获取 HTTPS 响应出错\n"
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr "VPN 服务不可用，原因：%s\n"
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr "收到不正确的 HTTP CONNECT 响应：%s\n"
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr "收到CONNECT响应：%s\n"
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr "选项的内存不足\n"
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr "未知的 CSTP-Content-Encoding %s\n"
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr "未收到 IP 地址。中止\n"
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr "重连给出了不同的旧 IP 地址(%s != %s)\n"
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr "重连给出了不同的旧 IP 网络掩码(%s != %s)\n"
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr "重连给出了不同的旧 IPv6 地址(%s != %s)\n"
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr "重连给出了不同的旧 IPv6 网络掩码(%s != %s)\n"
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr "CSTP 已连接。DPD %d, 保持连接 %d\n"
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr "压缩设置失败\n"
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr "重新分配缩小的缓存失败\n"
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr "缩减失败\n"
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr "包长度不对。SSL_read 返回 %d 但包长是\n"
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr "收到 CSTP DPD 请求\n"
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr "收到 CSTP DPD 响应\n"
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr "收到 CSTP 保持在线信号\n"
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr "收到未压缩的数据包，长度 %d 字节\n"
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr "收到服务器断开：%02x '%s'\n"
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr "在非 deflate 模式下收到了压缩包\n"
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr "收到服务器终止包\n"
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr "未知的包 %02x %02x %02x %02x %02x %02x %02x %02x\n"
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr "SSL 写入的字节过少！请求 %d，发送了 %d\n"
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr "重连失败\n"
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr "发送 CSTP DPD\n"
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr "发送 CSTP 保持在线信号\n"
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr "DTLS 握手超时\n"
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr "DTLS 握手失败：%d\n"
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr "DTLS 选项 %s : %s\n"
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr "尝试新的 DTLS 连接\n"
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr "收到 DTLS DPD 请求\n"
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr "收到 DTLS DPD 响应\n"
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr "发送 DTLS DPD\n"
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -936,6 +875,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr "DTLS 握手超时\n"
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -956,7 +986,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -975,7 +1005,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -984,485 +1014,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1656,7 +1690,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1674,235 +1708,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr "收到 HTTP 响应：%s\n"
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr "处理 HTTP 响应出错\n"
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr "常规错误"
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr "网络不可达"
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr "主机不可达"
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr "TTL 过期"
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr "命令不支持/协议错误"
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr "不支持的地址类型"
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1915,407 +1949,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr "启用压缩(默认;)"
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr "禁用压缩"
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr "设置登录的用户组"
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr "显示帮助文本"
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr "设置代理服务器"
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr "禁用代理"
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr "简化输出"
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr "设置登录用户名"
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr "报告版本号"
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr "更多输出"
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr "XML 配置文件"
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2323,173 +2370,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2497,89 +2551,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr "取消"
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr "确定"
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr "认证选择“%s”不可用\n"
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2594,16 +2659,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2669,7 +2734,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2801,501 +2866,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr "DTLS 握手失败：%d\n"
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr "SSL 读取错误 %d (服务器可能断开了连接)；正在重连。\n"
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr "SSL_write 失败：%d\n"
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ";<错误>"
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr "SSL连接失败\n"
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3592,83 +3766,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/zh_HK.po b/po/zh_HK.po
index 0afc8c0f..88a4888f 100644
--- a/po/zh_HK.po
+++ b/po/zh_HK.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: network-manager-openconnect 0.8.1\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2011-01-25 19:35+0800\n"
 "Last-Translator: Chao-Hsiung Liao <j_h_liau@yahoo.com.tw>\n"
 "Language-Team: Chinese (Hong Kong) <community@linuxhall.org>\n"
@@ -169,7 +169,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -296,541 +296,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -932,6 +871,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -952,7 +982,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -971,7 +1001,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -980,485 +1010,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1652,7 +1686,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1670,235 +1704,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1911,407 +1945,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2319,173 +2366,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2493,89 +2547,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2590,16 +2655,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2665,7 +2730,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2797,501 +2862,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3588,83 +3762,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/zh_TW.po b/po/zh_TW.po
index 42483eeb..3d37da9a 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2012-12-14 15:03+0000\n"
 "Last-Translator: Cheng-Chia Tseng <pswo10680@gmail.com>\n"
 "Language-Team: Chinese (Taiwan) (http://www.transifex.com/projects/p/meego/"
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -299,541 +299,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -935,6 +874,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -955,7 +985,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -974,7 +1004,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -983,485 +1013,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1655,7 +1689,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1673,235 +1707,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1914,407 +1948,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2322,173 +2369,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2496,89 +2550,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2593,16 +2658,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2668,7 +2733,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2800,501 +2865,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3591,83 +3765,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""
 
diff --git a/po/zu.po b/po/zu.po
index 371ec446..f9e94161 100644
--- a/po/zu.po
+++ b/po/zu.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: openconnect\n"
 "Report-Msgid-Bugs-To: openconnect-devel@lists.infradead.org\n"
-"POT-Creation-Date: 2016-08-30 21:03+0100\n"
+"POT-Creation-Date: 2016-12-13 12:03+0000\n"
 "PO-Revision-Date: 2014-02-19 09:05+0000\n"
 "Last-Translator: David Woodhouse <dwmw2@infradead.org>\n"
 "Language-Team: Zulu (http://www.transifex.com/projects/p/meego/language/"
@@ -171,7 +171,7 @@ msgstr ""
 msgid "Not downloading XML profile because SHA1 already matches\n"
 msgstr ""
 
-#: auth.c:921 cstp.c:293 http.c:877
+#: auth.c:921 cstp.c:320 http.c:886
 #, c-format
 msgid "Failed to open HTTPS connection to %s\n"
 msgstr ""
@@ -298,541 +298,480 @@ msgstr ""
 msgid "ERROR: Cannot initialize sockets\n"
 msgstr ""
 
-#: cstp.c:109
+#: cstp.c:112
 #, c-format
 msgid "TCP_INFO rcv mss %d, snd mss %d, adv mss %d, pmtu %d\n"
 msgstr ""
 
-#: cstp.c:131
+#: cstp.c:134
 #, c-format
 msgid "TCP_MAXSEG %d\n"
 msgstr ""
 
-#: cstp.c:252
+#: cstp.c:279
 msgid ""
 "CRITICAL ERROR: DTLS master secret is uninitialised. Please report this.\n"
 msgstr ""
 
-#: cstp.c:270
+#: cstp.c:297
 msgid "Error creating HTTPS CONNECT request\n"
 msgstr ""
 
-#: cstp.c:286 http.c:361
+#: cstp.c:313 http.c:370
 msgid "Error fetching HTTPS response\n"
 msgstr ""
 
-#: cstp.c:313
+#: cstp.c:340
 #, c-format
 msgid "VPN service unavailable; reason: %s\n"
 msgstr ""
 
-#: cstp.c:318
+#: cstp.c:345
 #, c-format
 msgid "Got inappropriate HTTP CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:325
+#: cstp.c:352
 #, c-format
 msgid "Got CONNECT response: %s\n"
 msgstr ""
 
-#: cstp.c:353 cstp.c:361
+#: cstp.c:380 cstp.c:388
 msgid "No memory for options\n"
 msgstr ""
 
-#: cstp.c:370 http.c:421
+#: cstp.c:397 http.c:430
 msgid "<elided>"
 msgstr ""
 
-#: cstp.c:387
+#: cstp.c:416
 #, c-format
 msgid "X-DTLS-Session-ID not 64 characters; is: \"%s\"\n"
 msgstr ""
 
-#: cstp.c:410
+#: cstp.c:433
+#, c-format
+msgid "X-DTLS-Session-ID is invalid; is: \"%s\"\n"
+msgstr ""
+
+#: cstp.c:451
 #, c-format
 msgid "Unknown DTLS-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:446
+#: cstp.c:487
 #, c-format
 msgid "Unknown CSTP-Content-Encoding %s\n"
 msgstr ""
 
-#: cstp.c:519
+#: cstp.c:562
 msgid "No MTU received. Aborting\n"
 msgstr ""
 
-#: cstp.c:527
+#: cstp.c:570
 msgid "No IP address received. Aborting\n"
 msgstr ""
 
-#: cstp.c:533
+#: cstp.c:576
 #, c-format
 msgid "IPv6 configuration received but MTU %d is too small.\n"
 msgstr ""
 
-#: cstp.c:539
+#: cstp.c:582
 #, c-format
 msgid "Reconnect gave different Legacy IP address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:547
+#: cstp.c:590
 #, c-format
 msgid "Reconnect gave different Legacy IP netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:555
+#: cstp.c:598
 #, c-format
 msgid "Reconnect gave different IPv6 address (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:563
+#: cstp.c:606
 #, c-format
 msgid "Reconnect gave different IPv6 netmask (%s != %s)\n"
 msgstr ""
 
-#: cstp.c:583
+#: cstp.c:626
 #, c-format
 msgid "CSTP connected. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: cstp.c:585
+#: cstp.c:628
 #, c-format
 msgid "CSTP Ciphersuite: %s\n"
 msgstr ""
 
-#: cstp.c:647
+#: cstp.c:690
 msgid "Compression setup failed\n"
 msgstr ""
 
-#: cstp.c:664
+#: cstp.c:707
 msgid "Allocation of deflate buffer failed\n"
 msgstr ""
 
-#: cstp.c:722
+#: cstp.c:765
 msgid "inflate failed\n"
 msgstr ""
 
-#: cstp.c:745
+#: cstp.c:788
 #, c-format
 msgid "LZS decompression failed: %s\n"
 msgstr ""
 
-#: cstp.c:758
+#: cstp.c:801
 msgid "LZ4 decompression failed\n"
 msgstr ""
 
-#: cstp.c:765
+#: cstp.c:808
 #, c-format
 msgid "Unknown compression type %d\n"
 msgstr ""
 
-#: cstp.c:770
+#: cstp.c:813
 #, c-format
 msgid "Received %s compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:790
+#: cstp.c:833
 #, c-format
 msgid "deflate failed %d\n"
 msgstr ""
 
-#: cstp.c:860 dtls.c:887 dtls.c:1357 esp.c:171 mainloop.c:67 oncp.c:931
+#: cstp.c:903 dtls.c:257 dtls.c:716 esp.c:171 mainloop.c:67 oncp.c:933
 msgid "Allocation failed\n"
 msgstr ""
 
-#: cstp.c:871
+#: cstp.c:914
 #, c-format
 msgid "Short packet received (%d bytes)\n"
 msgstr ""
 
-#: cstp.c:884
+#: cstp.c:927
 #, c-format
 msgid "Unexpected packet length. SSL_read returned %d but packet is\n"
 msgstr ""
 
-#: cstp.c:898
+#: cstp.c:941
 msgid "Got CSTP DPD request\n"
 msgstr ""
 
-#: cstp.c:904
+#: cstp.c:947
 msgid "Got CSTP DPD response\n"
 msgstr ""
 
-#: cstp.c:909
+#: cstp.c:952
 msgid "Got CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:914 oncp.c:1020
+#: cstp.c:957 oncp.c:1022
 #, c-format
 msgid "Received uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:931
+#: cstp.c:974
 #, c-format
 msgid "Received server disconnect: %02x '%s'\n"
 msgstr ""
 
-#: cstp.c:934
+#: cstp.c:977
 msgid "Received server disconnect\n"
 msgstr ""
 
-#: cstp.c:942
+#: cstp.c:985
 msgid "Compressed packet received in !deflate mode\n"
 msgstr ""
 
-#: cstp.c:951
+#: cstp.c:994
 msgid "received server terminate packet\n"
 msgstr ""
 
-#: cstp.c:958
+#: cstp.c:1001
 #, c-format
 msgid "Unknown packet %02x %02x %02x %02x %02x %02x %02x %02x\n"
 msgstr ""
 
-#: cstp.c:1001 oncp.c:1137
+#: cstp.c:1044 oncp.c:1139
 #, c-format
 msgid "SSL wrote too few bytes! Asked for %d, sent %d\n"
 msgstr ""
 
 #. Not that this will ever happen; we don't even process
 #. the setting when we're asked for it.
-#: cstp.c:1029 oncp.c:1175
+#: cstp.c:1072 oncp.c:1177
 msgid "CSTP rekey due\n"
 msgstr ""
 
 #. if we failed rehandshake try establishing a new-tunnel instead of failing
-#: cstp.c:1036 oncp.c:1182
+#: cstp.c:1079 oncp.c:1184
 msgid "Rehandshake failed; attempting new-tunnel\n"
 msgstr ""
 
-#: cstp.c:1047 oncp.c:1193
+#: cstp.c:1090 oncp.c:1195
 msgid "CSTP Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: cstp.c:1051 oncp.c:1107 oncp.c:1197
+#: cstp.c:1094 oncp.c:1109 oncp.c:1199
 msgid "Reconnect failed\n"
 msgstr ""
 
-#: cstp.c:1067 oncp.c:1213
+#: cstp.c:1110 oncp.c:1215
 msgid "Send CSTP DPD\n"
 msgstr ""
 
-#: cstp.c:1079 oncp.c:1224
+#: cstp.c:1122 oncp.c:1226
 msgid "Send CSTP Keepalive\n"
 msgstr ""
 
-#: cstp.c:1104
+#: cstp.c:1147
 #, c-format
 msgid "Sending compressed data packet of %d bytes (was %d)\n"
 msgstr ""
 
-#: cstp.c:1115 oncp.c:1249
+#: cstp.c:1158 oncp.c:1251
 #, c-format
 msgid "Sending uncompressed data packet of %d bytes\n"
 msgstr ""
 
-#: cstp.c:1154
+#: cstp.c:1197
 #, c-format
 msgid "Send BYE packet: %s\n"
 msgstr ""
 
-#: digest.c:254
+#: digest.c:252
 msgid "Attempting Digest authentication to proxy\n"
 msgstr ""
 
-#: digest.c:257
+#: digest.c:255
 #, c-format
 msgid "Attempting Digest authentication to server '%s'\n"
 msgstr ""
 
-#: dtls.c:184
-#, c-format
-msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
-msgstr ""
-
-#: dtls.c:195
-msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
-msgstr ""
-
-#: dtls.c:209
-msgid "Initialise DTLSv1 session failed\n"
-msgstr ""
-
-#: dtls.c:263
-msgid "Initialise DTLSv1 CTX failed\n"
-msgstr ""
-
-#: dtls.c:275
-msgid "Set DTLS CTX version failed\n"
-msgstr ""
-
-#: dtls.c:290
-msgid "Set DTLS cipher list failed\n"
-msgstr ""
-
-#: dtls.c:303
-msgid "Not precisely one DTLS cipher\n"
-msgstr ""
-
-#: dtls.c:325
-#, c-format
-msgid ""
-"SSL_set_session() failed with old protocol version 0x%x\n"
-"Are you using a version of OpenSSL older than 0.9.8m?\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
-"Use the --no-dtls command line option to avoid this message\n"
-msgstr ""
-
-#: dtls.c:358
-#, c-format
-msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:364 dtls.c:671
-#, c-format
-msgid "DTLS connection compression using %s.\n"
-msgstr ""
-
-#: dtls.c:395
-msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
-msgstr ""
-
-#: dtls.c:444 dtls.c:448 dtls.c:686
-msgid "DTLS handshake timed out\n"
-msgstr ""
-
-#: dtls.c:445
-msgid ""
-"This is probably because your OpenSSL is broken\n"
-"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
-msgstr ""
-
-#: dtls.c:452
-#, c-format
-msgid "DTLS handshake failed: %d\n"
-msgstr ""
-
-#: dtls.c:590
-#, c-format
-msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
-msgstr ""
-
-#: dtls.c:603
-#, c-format
-msgid "Failed to set DTLS priority: %s\n"
-msgstr ""
-
-#: dtls.c:624
-#, c-format
-msgid "Failed to set DTLS session parameters: %s\n"
-msgstr ""
-
-#: dtls.c:647
-#, c-format
-msgid "Failed to set DTLS MTU: %s\n"
-msgstr ""
-
-#: dtls.c:665
-#, c-format
-msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
-msgstr ""
-
-#: dtls.c:689
-#, c-format
-msgid "DTLS handshake failed: %s\n"
-msgstr ""
-
-#: dtls.c:693
-msgid "(Is a firewall preventing you from sending UDP packets?)\n"
-msgstr ""
-
-#: dtls.c:714
+#: dtls.c:93
 msgid "DTLS connection attempted with an existing fd\n"
 msgstr ""
 
-#: dtls.c:720
+#: dtls.c:99
 msgid "No DTLS address\n"
 msgstr ""
 
 #. We probably didn't offer it any ciphers it liked
-#: dtls.c:727
+#: dtls.c:106
 msgid "Server offered no DTLS cipher option\n"
 msgstr ""
 
 #. XXX: Theoretically, SOCKS5 proxies can do UDP too
-#: dtls.c:734
+#: dtls.c:113
 msgid "No DTLS when connected via proxy\n"
 msgstr ""
 
-#: dtls.c:805
+#: dtls.c:175
 #, c-format
 msgid "DTLS option %s : %s\n"
 msgstr ""
 
-#: dtls.c:846
+#: dtls.c:216
 #, c-format
 msgid "DTLS initialised. DPD %d, Keepalive %d\n"
 msgstr ""
 
-#: dtls.c:872
+#: dtls.c:242
 msgid "Attempt new DTLS connection\n"
 msgstr ""
 
-#: dtls.c:898
+#: dtls.c:268
 #, c-format
 msgid "Received DTLS packet 0x%02x of %d bytes\n"
 msgstr ""
 
-#: dtls.c:912
+#: dtls.c:282
 msgid "Got DTLS DPD request\n"
 msgstr ""
 
-#: dtls.c:918
+#: dtls.c:288
 msgid "Failed to send DPD response. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:922
+#: dtls.c:292
 msgid "Got DTLS DPD response\n"
 msgstr ""
 
-#: dtls.c:926
+#: dtls.c:296
 msgid "Got DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:932
+#: dtls.c:302
 msgid "Compressed DTLS packet received when compression not enabled\n"
 msgstr ""
 
-#: dtls.c:940
+#: dtls.c:310
 #, c-format
 msgid "Unknown DTLS packet type %02x, len %d\n"
 msgstr ""
 
-#: dtls.c:962
+#: dtls.c:332
 msgid "DTLS rekey due\n"
 msgstr ""
 
-#: dtls.c:969
+#: dtls.c:339
 msgid "DTLS Rehandshake failed; reconnecting.\n"
 msgstr ""
 
-#: dtls.c:978
+#: dtls.c:348
 msgid "DTLS Dead Peer Detection detected dead peer!\n"
 msgstr ""
 
-#: dtls.c:984
+#: dtls.c:354
 msgid "Send DTLS DPD\n"
 msgstr ""
 
-#: dtls.c:989
+#: dtls.c:359
 msgid "Failed to send DPD request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1002
+#: dtls.c:372
 msgid "Send DTLS Keepalive\n"
 msgstr ""
 
-#: dtls.c:1007
+#: dtls.c:377
 msgid "Failed to send keepalive request. Expect disconnect\n"
 msgstr ""
 
-#: dtls.c:1038 tun.c:541
+#: dtls.c:408 tun.c:541
 #, c-format
 msgid "Unknown packet (len %d) received: %02x %02x %02x %02x...\n"
 msgstr ""
 
-#: dtls.c:1045
+#: dtls.c:415
 #, c-format
 msgid "TOS this: %d, TOS last: %d\n"
 msgstr ""
 
-#: dtls.c:1049
+#: dtls.c:419
 msgid "UDP setsockopt"
 msgstr ""
 
-#: dtls.c:1080
+#: dtls.c:450
 #, c-format
 msgid "DTLS got write error %d. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1094
+#: dtls.c:464
 #, c-format
 msgid "DTLS got write error: %s. Falling back to SSL\n"
 msgstr ""
 
-#: dtls.c:1109
+#: dtls.c:479
 #, c-format
 msgid "Sent DTLS packet of %d bytes; DTLS send returned %d\n"
 msgstr ""
 
-#: dtls.c:1127
-msgid "SSL operation cancelled\n"
+#: dtls.c:507
+#, c-format
+msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
 msgstr ""
 
-#: dtls.c:1169
+#: dtls.c:527
+msgid "Too long time in MTU detect loop; assuming negotiated MTU.\n"
+msgstr ""
+
+#: dtls.c:531
 #, c-format
-msgid "Initiating IPv4 MTU detection (min=%d, max=%d)\n"
+msgid "Too long time in MTU detect loop; MTU set to %d.\n"
 msgstr ""
 
-#: dtls.c:1174
-msgid "Too long time in MTU detect loop; bailing out.\n"
+#: dtls.c:540
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes, min=%u, max=%u)\n"
 msgstr ""
 
-#: dtls.c:1197 dtls.c:1283
+#: dtls.c:544
 #, c-format
-msgid "Failed to send DPD request (%d): %s\n"
+msgid "Failed to send DPD request (%d %d)\n"
 msgstr ""
 
-#: dtls.c:1217 dtls.c:1309
+#: dtls.c:558 dtls.c:666
 #, c-format
 msgid "Received unexpected packet (%.2x) in MTU detection; skipping.\n"
 msgstr ""
 
-#: dtls.c:1223 dtls.c:1325
+#: dtls.c:570
+#, c-format
+msgid "Timeout while waiting for DPD response; trying %d\n"
+msgstr ""
+
+#: dtls.c:577 dtls.c:658
+msgid "Timeout while waiting for DPD response; resending probe.\n"
+msgstr ""
+
+#: dtls.c:584 dtls.c:685
+#, c-format
+msgid "Failed to recv DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:589
 #, c-format
-msgid "Failed to recv DPD request (%d): %s\n"
+msgid "Received MTU DPD probe (%u bytes of %u)\n"
 msgstr ""
 
-#: dtls.c:1263
+#: dtls.c:627
 msgid "Initiating IPv6 MTU detection\n"
 msgstr ""
 
-#: dtls.c:1378
+#: dtls.c:642
+#, c-format
+msgid "Sending MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:646
+#, c-format
+msgid "Failed to send DPD request (%d)\n"
+msgstr ""
+
+#: dtls.c:671
+#, c-format
+msgid "Received MTU DPD probe (%u bytes)\n"
+msgstr ""
+
+#: dtls.c:735
 #, c-format
 msgid "Detected MTU of %d bytes (was %d)\n"
 msgstr ""
 
-#: dtls.c:1381
+#: dtls.c:738
 #, c-format
 msgid "No change in MTU after detection (was %d)\n"
 msgstr ""
 
-#: esp-seqno.c:59
+#: esp-seqno.c:61
 #, c-format
 msgid "Accepting expected ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:65
+#: esp-seqno.c:91
 #, c-format
-msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid ""
+"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:74
+#: esp-seqno.c:103
 #, c-format
-msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Discarding ancient ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
-#: esp-seqno.c:80
+#: esp-seqno.c:110
 #, c-format
 msgid "Discarding replayed ESP packet with seq %u\n"
 msgstr ""
 
-#: esp-seqno.c:109
+#: esp-seqno.c:122
 #, c-format
-msgid ""
-"Accepting later-than-expected ESP packet with seq %u (expected %<PRIu64>)\n"
+msgid "Accepting out-of-order ESP packet with seq %u (expected %<PRIu64>)\n"
 msgstr ""
 
 #: esp.c:68
@@ -934,6 +873,97 @@ msgstr ""
 msgid "Sent ESP packet of %d bytes\n"
 msgstr ""
 
+#: gnutls-dtls.c:168
+msgid "Failed to generate DTLS priority string\n"
+msgstr ""
+
+#: gnutls-dtls.c:177
+#, c-format
+msgid "Failed to initialize DTLS: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:186
+#, c-format
+msgid "Failed to set DTLS priority: '%s': %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:198
+#, c-format
+msgid "Failed to allocate credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:211
+#, c-format
+msgid "Failed to generate DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:225
+#, c-format
+msgid "Failed to set DTLS key: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:233
+#, c-format
+msgid "Failed to set DTLS PSK credentials: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:266
+#, c-format
+msgid "Unknown DTLS parameters for requested CipherSuite '%s'\n"
+msgstr ""
+
+#: gnutls-dtls.c:281
+#, c-format
+msgid "Failed to set DTLS priority: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:302
+#, c-format
+msgid "Failed to set DTLS session parameters: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:330 openssl-dtls.c:484
+#, c-format
+msgid "Peer MTU %d too small to allow DTLS\n"
+msgstr ""
+
+#: gnutls-dtls.c:339 openssl-dtls.c:495
+#, c-format
+msgid "DTLS MTU reduced to %d\n"
+msgstr ""
+
+#: gnutls-dtls.c:349 openssl-dtls.c:504
+msgid "DTLS session resume failed; possible MITM attack. Disabling DTLS.\n"
+msgstr ""
+
+#: gnutls-dtls.c:363
+#, c-format
+msgid "Failed to set DTLS MTU: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:382
+#, c-format
+msgid "Established DTLS connection (using GnuTLS). Ciphersuite %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:388 openssl-dtls.c:522
+#, c-format
+msgid "DTLS connection compression using %s.\n"
+msgstr ""
+
+#: gnutls-dtls.c:403 openssl-dtls.c:603 openssl-dtls.c:607
+msgid "DTLS handshake timed out\n"
+msgstr ""
+
+#: gnutls-dtls.c:406
+#, c-format
+msgid "DTLS handshake failed: %s\n"
+msgstr ""
+
+#: gnutls-dtls.c:410
+msgid "(Is a firewall preventing you from sending UDP packets?)\n"
+msgstr ""
+
 #: gnutls-esp.c:56
 #, c-format
 msgid "Failed to initialise ESP cipher: %s\n"
@@ -954,7 +984,7 @@ msgstr ""
 msgid "Failed to calculate HMAC for ESP packet: %s\n"
 msgstr ""
 
-#: gnutls-esp.c:153 openssl-esp.c:193
+#: gnutls-esp.c:153 openssl-esp.c:191
 msgid "Received ESP packet with invalid HMAC\n"
 msgstr ""
 
@@ -973,7 +1003,7 @@ msgstr ""
 msgid "Failed to encrypt ESP packet: %s\n"
 msgstr ""
 
-#: gnutls.c:126 openssl.c:141
+#: gnutls.c:126 openssl.c:154
 msgid "SSL write cancelled\n"
 msgstr ""
 
@@ -982,485 +1012,489 @@ msgstr ""
 msgid "Failed to write to SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:159 gnutls.c:223 openssl.c:173 openssl.c:226
+#: gnutls.c:176 gnutls.c:268 openssl.c:204 openssl.c:271
 msgid "SSL read cancelled\n"
 msgstr ""
 
 #. We've seen this with HTTP 1.0 responses followed by abrupt
 #. socket closure and no clean SSL shutdown.
 #. https://bugs.launchpad.net/bugs/1225276
-#: gnutls.c:166
+#: gnutls.c:189
 msgid "SSL socket closed uncleanly\n"
 msgstr ""
 
-#: gnutls.c:173 gnutls.c:232
+#: gnutls.c:199 gnutls.c:277
 #, c-format
 msgid "Failed to read from SSL socket: %s\n"
 msgstr ""
 
-#: gnutls.c:252
+#: gnutls.c:297
 #, c-format
 msgid "SSL read error: %s; reconnecting.\n"
 msgstr ""
 
-#: gnutls.c:288
+#: gnutls.c:333
 #, c-format
 msgid "SSL send failed: %s\n"
 msgstr ""
 
-#: gnutls.c:301
+#: gnutls.c:346
 msgid "Could not extract expiration time of certificate\n"
 msgstr ""
 
-#: gnutls.c:306 openssl.c:1558
+#: gnutls.c:351 openssl.c:1621
 msgid "Client certificate has expired at"
 msgstr ""
 
-#: gnutls.c:308 openssl.c:1563
+#: gnutls.c:353 openssl.c:1626
 msgid "Client certificate expires soon at"
 msgstr ""
 
-#: gnutls.c:357 openssl.c:754
+#: gnutls.c:402 openssl.c:799
 #, c-format
 msgid "Failed to load item '%s' from keystore: %s\n"
 msgstr ""
 
-#: gnutls.c:370
+#: gnutls.c:415
 #, c-format
 msgid "Failed to open key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:377
+#: gnutls.c:422
 #, c-format
 msgid "Failed to stat key/certificate file %s: %s\n"
 msgstr ""
 
-#: gnutls.c:386
+#: gnutls.c:431
 msgid "Failed to allocate certificate buffer\n"
 msgstr ""
 
-#: gnutls.c:394
+#: gnutls.c:439
 #, c-format
 msgid "Failed to read certificate into memory: %s\n"
 msgstr ""
 
-#: gnutls.c:425
+#: gnutls.c:470
 #, c-format
 msgid "Failed to setup PKCS#12 data structure: %s\n"
 msgstr ""
 
-#: gnutls.c:448 openssl.c:523
+#: gnutls.c:493 openssl.c:568
 msgid "Failed to decrypt PKCS#12 certificate file\n"
 msgstr ""
 
-#: gnutls.c:452 openssl.c:526
+#: gnutls.c:497 openssl.c:571
 msgid "Enter PKCS#12 pass phrase:"
 msgstr ""
 
-#: gnutls.c:475
+#: gnutls.c:520
 #, c-format
 msgid "Failed to process PKCS#12 file: %s\n"
 msgstr ""
 
-#: gnutls.c:487
+#: gnutls.c:532
 #, c-format
 msgid "Failed to load PKCS#12 certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:647
+#: gnutls.c:692
 #, c-format
 msgid "Importing X509 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:657
+#: gnutls.c:702
 #, c-format
 msgid "Setting PKCS#11 certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:697
+#: gnutls.c:742
 #, c-format
 msgid "Could not initialise MD5 hash: %s\n"
 msgstr ""
 
-#: gnutls.c:707
+#: gnutls.c:752
 #, c-format
 msgid "MD5 hash error: %s\n"
 msgstr ""
 
-#: gnutls.c:765
+#: gnutls.c:810
 msgid "Missing DEK-Info: header from OpenSSL encrypted key\n"
 msgstr ""
 
-#: gnutls.c:772
+#: gnutls.c:817
 msgid "Cannot determine PEM encryption type\n"
 msgstr ""
 
-#: gnutls.c:785
+#: gnutls.c:830
 #, c-format
 msgid "Unsupported PEM encryption type: %s\n"
 msgstr ""
 
-#: gnutls.c:810 gnutls.c:823
+#: gnutls.c:855 gnutls.c:868
 msgid "Invalid salt in encrypted PEM file\n"
 msgstr ""
 
-#: gnutls.c:847
+#: gnutls.c:892
 #, c-format
 msgid "Error base64-decoding encrypted PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:855
+#: gnutls.c:900
 msgid "Encrypted PEM file too short\n"
 msgstr ""
 
-#: gnutls.c:883
+#: gnutls.c:928
 #, c-format
 msgid "Failed to initialise cipher for decrypting PEM file: %s\n"
 msgstr ""
 
-#: gnutls.c:894
+#: gnutls.c:939
 #, c-format
 msgid "Failed to decrypt PEM key: %s\n"
 msgstr ""
 
-#: gnutls.c:946
+#: gnutls.c:991
 msgid "Decrypting PEM key failed\n"
 msgstr ""
 
-#: gnutls.c:951 gnutls.c:1485 openssl.c:447
+#: gnutls.c:996 gnutls.c:1530 openssl.c:492
 msgid "Enter PEM pass phrase:"
 msgstr ""
 
-#: gnutls.c:1018
+#: gnutls.c:1063
 msgid "This binary built without system key support\n"
 msgstr ""
 
-#: gnutls.c:1025
+#: gnutls.c:1070
 msgid "This binary built without PKCS#11 support\n"
 msgstr ""
 
-#: gnutls.c:1083 openssl-pkcs11.c:388
+#: gnutls.c:1128 openssl-pkcs11.c:407
 #, c-format
 msgid "Using PKCS#11 certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1084
+#: gnutls.c:1129
 #, c-format
 msgid "Using system certificate %s\n"
 msgstr ""
 
-#: gnutls.c:1102
+#: gnutls.c:1147
 #, c-format
 msgid "Error loading certificate from PKCS#11: %s\n"
 msgstr ""
 
-#: gnutls.c:1103
+#: gnutls.c:1148
 #, c-format
 msgid "Error loading system certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1114 openssl.c:809
+#: gnutls.c:1159 openssl.c:855
 #, c-format
 msgid "Using certificate file %s\n"
 msgstr ""
 
-#: gnutls.c:1142
+#: gnutls.c:1187
 msgid "PKCS#11 file contained no certificate\n"
 msgstr ""
 
-#: gnutls.c:1168
+#: gnutls.c:1213
 msgid "No certificate found in file"
 msgstr ""
 
-#: gnutls.c:1173
+#: gnutls.c:1218
 #, c-format
 msgid "Loading certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1188
+#: gnutls.c:1233
 #, c-format
 msgid "Using system key %s\n"
 msgstr ""
 
-#: gnutls.c:1193 gnutls.c:1357
+#: gnutls.c:1238 gnutls.c:1402
 #, c-format
 msgid "Error initialising private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1204
+#: gnutls.c:1249
 #, c-format
 msgid "Error importing system key %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1215 gnutls.c:1305 gnutls.c:1333
+#: gnutls.c:1260 gnutls.c:1350 gnutls.c:1378
 #, c-format
 msgid "Trying PKCS#11 key URL %s\n"
 msgstr ""
 
-#: gnutls.c:1220
+#: gnutls.c:1265
 #, c-format
 msgid "Error initialising PKCS#11 key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1345
+#: gnutls.c:1390
 #, c-format
 msgid "Error importing PKCS#11 URL %s: %s\n"
 msgstr ""
 
-#: gnutls.c:1352 openssl-pkcs11.c:558
+#: gnutls.c:1397 openssl-pkcs11.c:644
 #, c-format
 msgid "Using PKCS#11 key %s\n"
 msgstr ""
 
-#: gnutls.c:1367
+#: gnutls.c:1412
 #, c-format
 msgid "Error importing PKCS#11 key into private key structure: %s\n"
 msgstr ""
 
-#: gnutls.c:1395
+#: gnutls.c:1440
 #, c-format
 msgid "Using private key file %s\n"
 msgstr ""
 
-#: gnutls.c:1406 openssl.c:634
+#: gnutls.c:1451 openssl.c:679
 msgid "This version of OpenConnect was built without TPM support\n"
 msgstr ""
 
-#: gnutls.c:1427
+#: gnutls.c:1472
 msgid "Failed to interpret PEM file\n"
 msgstr ""
 
-#: gnutls.c:1446
+#: gnutls.c:1491
 #, c-format
 msgid "Failed to load PKCS#1 private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1459 gnutls.c:1473
+#: gnutls.c:1504 gnutls.c:1518
 #, c-format
 msgid "Failed to load private key as PKCS#8: %s\n"
 msgstr ""
 
-#: gnutls.c:1481 gnutls.c:1514 openssl.c:967 openssl.c:977
+#: gnutls.c:1526 gnutls.c:1559 openssl.c:1026 openssl.c:1036
 msgid "Failed to decrypt PKCS#8 certificate file\n"
 msgstr ""
 
-#: gnutls.c:1506
+#: gnutls.c:1551
 #, c-format
 msgid "Failed to determine type of private key %s\n"
 msgstr ""
 
-#: gnutls.c:1518 openssl.c:973
+#: gnutls.c:1563 openssl.c:1032
 msgid "Enter PKCS#8 pass phrase:"
 msgstr ""
 
-#: gnutls.c:1534
+#: gnutls.c:1579
 #, c-format
 msgid "Failed to get key ID: %s\n"
 msgstr ""
 
-#: gnutls.c:1579
+#: gnutls.c:1624
 #, c-format
 msgid "Error signing test data with private key: %s\n"
 msgstr ""
 
-#: gnutls.c:1594
+#: gnutls.c:1639
 #, c-format
 msgid "Error validating signature against certificate: %s\n"
 msgstr ""
 
-#: gnutls.c:1618
+#: gnutls.c:1663
 msgid "No SSL certificate found to match private key\n"
 msgstr ""
 
-#: gnutls.c:1630 openssl.c:549 openssl.c:692
+#: gnutls.c:1675 openssl.c:594 openssl.c:737
 #, c-format
 msgid "Using client certificate '%s'\n"
 msgstr ""
 
-#: gnutls.c:1637
+#: gnutls.c:1682
 #, c-format
 msgid "Setting certificate revocation list failed: %s\n"
 msgstr ""
 
-#: gnutls.c:1658 gnutls.c:1668
+#: gnutls.c:1703 gnutls.c:1713
 msgid "Failed to allocate memory for certificate\n"
 msgstr ""
 
-#: gnutls.c:1704
+#: gnutls.c:1749
 msgid ""
 "WARNING: GnuTLS returned incorrect issuer certs; authentication may fail!\n"
 msgstr ""
 
-#: gnutls.c:1732
+#: gnutls.c:1772
+msgid "Got no issuer from PKCS#11\n"
+msgstr ""
+
+#: gnutls.c:1777
 #, c-format
 msgid "Got next CA '%s' from PKCS11\n"
 msgstr ""
 
-#: gnutls.c:1758
+#: gnutls.c:1803
 msgid "Failed to allocate memory for supporting certificates\n"
 msgstr ""
 
-#: gnutls.c:1781
+#: gnutls.c:1826
 #, c-format
 msgid "Adding supporting CA '%s'\n"
 msgstr ""
 
-#: gnutls.c:1809
+#: gnutls.c:1854
 #, c-format
 msgid "Setting certificate failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2029
+#: gnutls.c:2078
 msgid "Server presented no certificate\n"
 msgstr ""
 
-#: gnutls.c:2037
+#: gnutls.c:2086
 #, c-format
 msgid "Error comparing server's cert on rehandshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2042 openssl.c:1481
+#: gnutls.c:2091 openssl.c:1544
 msgid "Server presented different cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2047 openssl.c:1484
+#: gnutls.c:2096 openssl.c:1547
 msgid "Server presented identical cert on rehandshake\n"
 msgstr ""
 
-#: gnutls.c:2053
+#: gnutls.c:2102
 msgid "Error initialising X509 cert structure\n"
 msgstr ""
 
-#: gnutls.c:2059
+#: gnutls.c:2108
 msgid "Error importing server's cert\n"
 msgstr ""
 
-#: gnutls.c:2068 main.c:1693
+#: gnutls.c:2117 main.c:1705
 msgid "Could not calculate hash of server's certificate\n"
 msgstr ""
 
-#: gnutls.c:2073
+#: gnutls.c:2122
 msgid "Error checking server cert status\n"
 msgstr ""
 
-#: gnutls.c:2078
+#: gnutls.c:2127
 msgid "certificate revoked"
 msgstr ""
 
-#: gnutls.c:2080
+#: gnutls.c:2129
 msgid "signer not found"
 msgstr ""
 
-#: gnutls.c:2082
+#: gnutls.c:2131
 msgid "signer not a CA certificate"
 msgstr ""
 
-#: gnutls.c:2084
+#: gnutls.c:2133
 msgid "insecure algorithm"
 msgstr ""
 
-#: gnutls.c:2086
+#: gnutls.c:2135
 msgid "certificate not yet activated"
 msgstr ""
 
-#: gnutls.c:2088
+#: gnutls.c:2137
 msgid "certificate expired"
 msgstr ""
 
 #. If this is set and no other reason, it apparently means
 #. that signature verification failed. Not entirely sure
 #. why we don't just set a bit for that too.
-#: gnutls.c:2093
+#: gnutls.c:2142
 msgid "signature verification failed"
 msgstr ""
 
-#: gnutls.c:2142 openssl.c:1365 openssl.c:1517
+#: gnutls.c:2191 openssl.c:1428 openssl.c:1580
 msgid "certificate does not match hostname"
 msgstr ""
 
-#: gnutls.c:2147 openssl.c:1364 openssl.c:1523
+#: gnutls.c:2196 openssl.c:1427 openssl.c:1586
 #, c-format
 msgid "Server certificate verify failed: %s\n"
 msgstr ""
 
-#: gnutls.c:2219
+#: gnutls.c:2270
 msgid "Failed to allocate memory for cafile certs\n"
 msgstr ""
 
-#: gnutls.c:2240
+#: gnutls.c:2291
 #, c-format
 msgid "Failed to read certs from cafile: %s\n"
 msgstr ""
 
-#: gnutls.c:2256
+#: gnutls.c:2307
 #, c-format
 msgid "Failed to open CA file '%s': %s\n"
 msgstr ""
 
-#: gnutls.c:2269 openssl.c:1635
+#: gnutls.c:2320 openssl.c:1710
 msgid "Loading certificate failed. Aborting.\n"
 msgstr ""
 
-#: gnutls.c:2340
+#: gnutls.c:2391
 #, c-format
 msgid "Failed to set TLS priority string (\"%s\"): %s\n"
 msgstr ""
 
-#: gnutls.c:2352 openssl.c:1752
+#: gnutls.c:2403 openssl.c:1827
 #, c-format
 msgid "SSL negotiation with %s\n"
 msgstr ""
 
-#: gnutls.c:2399 openssl.c:1778
+#: gnutls.c:2450 openssl.c:1853
 msgid "SSL connection cancelled\n"
 msgstr ""
 
-#: gnutls.c:2406
+#: gnutls.c:2457
 #, c-format
 msgid "SSL connection failure: %s\n"
 msgstr ""
 
-#: gnutls.c:2415
+#: gnutls.c:2466
 #, c-format
 msgid "GnuTLS non-fatal return during handshake: %s\n"
 msgstr ""
 
-#: gnutls.c:2421 openssl.c:1795
+#: gnutls.c:2472 openssl.c:1870
 #, c-format
 msgid "Connected to HTTPS on %s\n"
 msgstr ""
 
-#: gnutls.c:2424
+#: gnutls.c:2475
 #, c-format
 msgid "Renegotiated SSL on %s\n"
 msgstr ""
 
-#: gnutls.c:2607 openssl-pkcs11.c:183
+#: gnutls.c:2795 openssl-pkcs11.c:199
 #, c-format
 msgid "PIN required for %s"
 msgstr ""
 
-#: gnutls.c:2611 openssl-pkcs11.c:186
+#: gnutls.c:2799 openssl-pkcs11.c:202
 msgid "Wrong PIN"
 msgstr ""
 
-#: gnutls.c:2614
+#: gnutls.c:2802
 msgid "This is the final try before locking!"
 msgstr ""
 
-#: gnutls.c:2616
+#: gnutls.c:2804
 msgid "Only a few tries left before locking!"
 msgstr ""
 
-#: gnutls.c:2621 openssl-pkcs11.c:190
+#: gnutls.c:2809 openssl-pkcs11.c:206
 msgid "Enter PIN:"
 msgstr ""
 
-#: gnutls.c:2752 openssl.c:1923
+#: gnutls.c:2940 openssl.c:1998
 msgid "Unsupported OATH HMAC algorithm\n"
 msgstr ""
 
-#: gnutls.c:2761
+#: gnutls.c:2949
 #, c-format
 msgid "Failed to calculate OATH HMAC: %s\n"
 msgstr ""
@@ -1654,7 +1688,7 @@ msgstr ""
 msgid "Attempting HTTP Basic authentication to server '%s'\n"
 msgstr ""
 
-#: http-auth.c:200 http.c:1200
+#: http-auth.c:200 http.c:1209
 msgid "This version of OpenConnect was built without GSSAPI support\n"
 msgstr ""
 
@@ -1672,235 +1706,235 @@ msgstr ""
 msgid "No more authentication methods to try\n"
 msgstr ""
 
-#: http.c:296
+#: http.c:305
 msgid "No memory for allocating cookies\n"
 msgstr ""
 
-#: http.c:371
+#: http.c:380
 #, c-format
 msgid "Failed to parse HTTP response '%s'\n"
 msgstr ""
 
-#: http.c:377
+#: http.c:386
 #, c-format
 msgid "Got HTTP response: %s\n"
 msgstr ""
 
-#: http.c:385
+#: http.c:394
 msgid "Error processing HTTP response\n"
 msgstr ""
 
-#: http.c:392
+#: http.c:401
 #, c-format
 msgid "Ignoring unknown HTTP response line '%s'\n"
 msgstr ""
 
-#: http.c:412
+#: http.c:421
 #, c-format
 msgid "Invalid cookie offered: %s\n"
 msgstr ""
 
-#: http.c:431
+#: http.c:440
 msgid "SSL certificate authentication failed\n"
 msgstr ""
 
-#: http.c:462
+#: http.c:471
 #, c-format
 msgid "Response body has negative size (%d)\n"
 msgstr ""
 
-#: http.c:473
+#: http.c:482
 #, c-format
 msgid "Unknown Transfer-Encoding: %s\n"
 msgstr ""
 
 #. Now the body, if there is one
-#: http.c:492
+#: http.c:501
 #, c-format
 msgid "HTTP body %s (%d)\n"
 msgstr ""
 
-#: http.c:506 http.c:533
+#: http.c:515 http.c:542
 msgid "Error reading HTTP response body\n"
 msgstr ""
 
-#: http.c:519
+#: http.c:528
 msgid "Error fetching chunk header\n"
 msgstr ""
 
-#: http.c:543
+#: http.c:552
 msgid "Error fetching HTTP response body\n"
 msgstr ""
 
-#: http.c:546
+#: http.c:555
 #, c-format
 msgid "Error in chunked decoding. Expected '', got: '%s'"
 msgstr ""
 
-#: http.c:558
+#: http.c:567
 msgid "Cannot receive HTTP 1.0 body without closing connection\n"
 msgstr ""
 
-#: http.c:685
+#: http.c:694
 #, c-format
 msgid "Failed to parse redirected URL '%s': %s\n"
 msgstr ""
 
-#: http.c:709
+#: http.c:718
 #, c-format
 msgid "Cannot follow redirection to non-https URL '%s'\n"
 msgstr ""
 
-#: http.c:737
+#: http.c:746
 #, c-format
 msgid "Allocating new path for relative redirect failed: %s\n"
 msgstr ""
 
-#: http.c:929 oncp.c:591 oncp.c:627
+#: http.c:938 oncp.c:592 oncp.c:629
 #, c-format
 msgid "Unexpected %d result from server\n"
 msgstr ""
 
-#: http.c:1056
+#: http.c:1065
 msgid "request granted"
 msgstr ""
 
-#: http.c:1057
+#: http.c:1066
 msgid "general failure"
 msgstr ""
 
-#: http.c:1058
+#: http.c:1067
 msgid "connection not allowed by ruleset"
 msgstr ""
 
-#: http.c:1059
+#: http.c:1068
 msgid "network unreachable"
 msgstr ""
 
-#: http.c:1060
+#: http.c:1069
 msgid "host unreachable"
 msgstr ""
 
-#: http.c:1061
+#: http.c:1070
 msgid "connection refused by destination host"
 msgstr ""
 
-#: http.c:1062
+#: http.c:1071
 msgid "TTL expired"
 msgstr ""
 
-#: http.c:1063
+#: http.c:1072
 msgid "command not supported / protocol error"
 msgstr ""
 
-#: http.c:1064
+#: http.c:1073
 msgid "address type not supported"
 msgstr ""
 
-#: http.c:1074
+#: http.c:1083
 msgid "SOCKS server requested username/password but we have none\n"
 msgstr ""
 
-#: http.c:1082
+#: http.c:1091
 msgid "Username and password for SOCKS authentication must be < 255 bytes\n"
 msgstr ""
 
-#: http.c:1097 http.c:1153
+#: http.c:1106 http.c:1162
 #, c-format
 msgid "Error writing auth request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1105 http.c:1160
+#: http.c:1114 http.c:1169
 #, c-format
 msgid "Error reading auth response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1112 http.c:1166
+#: http.c:1121 http.c:1175
 #, c-format
 msgid "Unexpected auth response from SOCKS proxy: %02x %02x\n"
 msgstr ""
 
-#: http.c:1118
+#: http.c:1127
 msgid "Authenticated to SOCKS server using password\n"
 msgstr ""
 
-#: http.c:1122
+#: http.c:1131
 msgid "Password authentication to SOCKS server failed\n"
 msgstr ""
 
-#: http.c:1178 http.c:1185
+#: http.c:1187 http.c:1194
 msgid "SOCKS server requested GSSAPI authentication\n"
 msgstr ""
 
-#: http.c:1191
+#: http.c:1200
 msgid "SOCKS server requested password authentication\n"
 msgstr ""
 
-#: http.c:1198
+#: http.c:1207
 msgid "SOCKS server requires authentication\n"
 msgstr ""
 
-#: http.c:1205
+#: http.c:1214
 #, c-format
 msgid "SOCKS server requested unknown authentication type %02x\n"
 msgstr ""
 
-#: http.c:1211
+#: http.c:1220
 #, c-format
 msgid "Requesting SOCKS proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1226
+#: http.c:1235
 #, c-format
 msgid "Error writing connect request to SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1234 http.c:1276
+#: http.c:1243 http.c:1285
 #, c-format
 msgid "Error reading connect response from SOCKS proxy: %s\n"
 msgstr ""
 
-#: http.c:1240
+#: http.c:1249
 #, c-format
 msgid "Unexpected connect response from SOCKS proxy: %02x %02x...\n"
 msgstr ""
 
-#: http.c:1248
+#: http.c:1257
 #, c-format
 msgid "SOCKS proxy error %02x: %s\n"
 msgstr ""
 
-#: http.c:1252
+#: http.c:1261
 #, c-format
 msgid "SOCKS proxy error %02x\n"
 msgstr ""
 
-#: http.c:1269
+#: http.c:1278
 #, c-format
 msgid "Unexpected address type %02x in SOCKS connect response\n"
 msgstr ""
 
-#: http.c:1292
+#: http.c:1301
 #, c-format
 msgid "Requesting HTTP proxy connection to %s:%d\n"
 msgstr ""
 
-#: http.c:1327
+#: http.c:1336
 #, c-format
 msgid "Sending proxy request failed: %s\n"
 msgstr ""
 
-#: http.c:1350
+#: http.c:1359
 #, c-format
 msgid "Proxy CONNECT request failed: %d\n"
 msgstr ""
 
-#: http.c:1369
+#: http.c:1378
 #, c-format
 msgid "Unknown proxy type '%s'\n"
 msgstr ""
 
-#: http.c:1418
+#: http.c:1427
 msgid "Only http or socks(5) proxies supported\n"
 msgstr ""
 
@@ -1913,407 +1947,420 @@ msgstr ""
 msgid "Built against SSL library with no Cisco DTLS support\n"
 msgstr ""
 
-#: library.c:583
+#: library.c:584
 #, c-format
 msgid "Failed to parse server URL '%s'\n"
 msgstr ""
 
-#: library.c:589
+#: library.c:590
 msgid "Only https:// permitted for server URL\n"
 msgstr ""
 
-#: library.c:1012
+#: library.c:956
+#, c-format
+msgid "Unknown certificate hash: %s.\n"
+msgstr ""
+
+#: library.c:988
+#, c-format
+msgid ""
+"The size of the provided fingerprint is less than the minimum required "
+"(%u).\n"
+msgstr ""
+
+#: library.c:1047
 msgid "No form handler; cannot authenticate.\n"
 msgstr ""
 
-#: main.c:334
+#: main.c:333
 #, c-format
 msgid "CommandLineToArgvW() failed: %s\n"
 msgstr ""
 
-#: main.c:347
+#: main.c:346
 #, c-format
 msgid "Fatal error in command line handling\n"
 msgstr ""
 
-#: main.c:383
+#: main.c:382
+#, c-format
+msgid "Failed to open CONIN$: %s\n"
+msgstr ""
+
+#: main.c:394
 #, c-format
 msgid "ReadConsole() failed: %s\n"
 msgstr ""
 
-#: main.c:397 main.c:410
+#: main.c:408 main.c:421
 #, c-format
 msgid "Error converting console input: %s\n"
 msgstr ""
 
-#: main.c:404 main.c:640
+#: main.c:415 main.c:649
 #, c-format
 msgid "Allocation failure for string from stdin\n"
 msgstr ""
 
-#: main.c:571
+#: main.c:584
 #, c-format
 msgid ""
 "For assistance with OpenConnect, please see the web page at\n"
 "  http://www.infradead.org/openconnect/mail.html\n"
 msgstr ""
 
-#: main.c:580
+#: main.c:593
 #, c-format
 msgid "Using OpenSSL. Features present:"
 msgstr ""
 
-#: main.c:582
+#: main.c:595
 #, c-format
 msgid "Using GnuTLS. Features present:"
 msgstr ""
 
-#: main.c:591
+#: main.c:604
 msgid "OpenSSL ENGINE not present"
 msgstr ""
 
-#: main.c:623
-msgid "using OpenSSL"
-msgstr ""
-
-#: main.c:627
+#: main.c:636
 #, c-format
 msgid ""
 "\n"
 "WARNING: No DTLS support in this binary. Performance will be impaired.\n"
 msgstr ""
 
-#: main.c:664
+#: main.c:673
 msgid "fgets (stdin)"
 msgstr ""
 
-#: main.c:704
+#: main.c:713
 #, c-format
 msgid "Cannot process this executable path \"%s\""
 msgstr ""
 
-#: main.c:710
+#: main.c:719
 #, c-format
 msgid "Allocation for vpnc-script path failed\n"
 msgstr ""
 
-#: main.c:730
+#: main.c:739
 #, c-format
 msgid "Override hostname '%s' to '%s'\n"
 msgstr ""
 
-#: main.c:743
+#: main.c:752
 #, c-format
 msgid "Usage:  openconnect [options] <server>\n"
 msgstr ""
 
-#: main.c:744
+#: main.c:753
 #, c-format
 msgid ""
 "Open client for Cisco AnyConnect VPN, version %s\n"
 "\n"
 msgstr ""
 
-#: main.c:746
+#: main.c:755
 msgid "Read options from config file"
 msgstr ""
 
-#: main.c:748
+#: main.c:757
 msgid "Continue in background after startup"
 msgstr ""
 
-#: main.c:749
+#: main.c:758
 msgid "Write the daemon's PID to this file"
 msgstr ""
 
-#: main.c:751
+#: main.c:760
 msgid "Use SSL client certificate CERT"
 msgstr ""
 
-#: main.c:752
+#: main.c:761
 msgid "Warn when certificate lifetime < DAYS"
 msgstr ""
 
-#: main.c:753
+#: main.c:762
 msgid "Use SSL private key file KEY"
 msgstr ""
 
-#: main.c:754
+#: main.c:763
 msgid "Use WebVPN cookie COOKIE"
 msgstr ""
 
-#: main.c:755
+#: main.c:764
 msgid "Read cookie from standard input"
 msgstr ""
 
-#: main.c:756
+#: main.c:765
 msgid "Enable compression (default)"
 msgstr ""
 
-#: main.c:757
+#: main.c:766
 msgid "Disable compression"
 msgstr ""
 
-#: main.c:758
+#: main.c:767
 msgid "Set minimum Dead Peer Detection interval"
 msgstr ""
 
-#: main.c:759
+#: main.c:768
 msgid "Set login usergroup"
 msgstr ""
 
-#: main.c:760
+#: main.c:769
 msgid "Display help text"
 msgstr ""
 
-#: main.c:761
+#: main.c:770
 msgid "Use IFNAME for tunnel interface"
 msgstr ""
 
-#: main.c:763
+#: main.c:772
 msgid "Use syslog for progress messages"
 msgstr ""
 
-#: main.c:765
+#: main.c:774
 msgid "Prepend timestamp to progress messages"
 msgstr ""
 
-#: main.c:766
+#: main.c:775
 msgid "copy TOS / TCLASS when using DTLS"
 msgstr ""
 
-#: main.c:768
+#: main.c:777
 msgid "Drop privileges after connecting"
 msgstr ""
 
-#: main.c:769
+#: main.c:778
 msgid "Drop privileges during CSD execution"
 msgstr ""
 
-#: main.c:770
+#: main.c:779
 msgid "Run SCRIPT instead of CSD binary"
 msgstr ""
 
-#: main.c:772
+#: main.c:781
 msgid "Request MTU from server (legacy servers only)"
 msgstr ""
 
-#: main.c:773
+#: main.c:782
 msgid "Indicate path MTU to/from server"
 msgstr ""
 
-#: main.c:774
+#: main.c:783
 msgid "Set key passphrase or TPM SRK PIN"
 msgstr ""
 
-#: main.c:775
+#: main.c:784
 msgid "Key passphrase is fsid of file system"
 msgstr ""
 
-#: main.c:776
+#: main.c:785
 msgid "Set proxy server"
 msgstr ""
 
-#: main.c:777
+#: main.c:786
 msgid "Set proxy authentication methods"
 msgstr ""
 
-#: main.c:778
+#: main.c:787
 msgid "Disable proxy"
 msgstr ""
 
-#: main.c:779
+#: main.c:788
 msgid "Use libproxy to automatically configure proxy"
 msgstr ""
 
-#: main.c:781
+#: main.c:790
 msgid "(NOTE: libproxy disabled in this build)"
 msgstr ""
 
-#: main.c:783
+#: main.c:792
 msgid "Require perfect forward secrecy"
 msgstr ""
 
-#: main.c:784
+#: main.c:793
 msgid "Less output"
 msgstr ""
 
-#: main.c:785
+#: main.c:794
 msgid "Set packet queue limit to LEN pkts"
 msgstr ""
 
-#: main.c:786
+#: main.c:795
 msgid "Shell command line for using a vpnc-compatible config script"
 msgstr ""
 
-#: main.c:787
+#: main.c:796
 msgid "default"
 msgstr ""
 
-#: main.c:789
+#: main.c:798
 msgid "Pass traffic to 'script' program, not tun"
 msgstr ""
 
-#: main.c:791
+#: main.c:800
 msgid "Set login username"
 msgstr ""
 
-#: main.c:792
+#: main.c:801
 msgid "Report version number"
 msgstr ""
 
-#: main.c:793
+#: main.c:802
 msgid "More output"
 msgstr ""
 
-#: main.c:794
+#: main.c:803
 msgid "Dump HTTP authentication traffic (implies --verbose"
 msgstr ""
 
-#: main.c:795
+#: main.c:804
 msgid "XML config file"
 msgstr ""
 
-#: main.c:796
+#: main.c:805
 msgid "Choose authentication login selection"
 msgstr ""
 
-#: main.c:797
+#: main.c:806
 msgid "Authenticate only and print login info"
 msgstr ""
 
-#: main.c:798
+#: main.c:807
 msgid "Fetch webvpn cookie only; don't connect"
 msgstr ""
 
-#: main.c:799
+#: main.c:808
 msgid "Print webvpn cookie before connecting"
 msgstr ""
 
-#: main.c:800
+#: main.c:809
 msgid "Cert file for server verification"
 msgstr ""
 
-#: main.c:801
+#: main.c:810
 msgid "Do not ask for IPv6 connectivity"
 msgstr ""
 
-#: main.c:802
+#: main.c:811
 msgid "OpenSSL ciphers to support for DTLS"
 msgstr ""
 
-#: main.c:803
+#: main.c:812
 msgid "Disable DTLS"
 msgstr ""
 
-#: main.c:804
+#: main.c:813
 msgid "Disable HTTP connection re-use"
 msgstr ""
 
-#: main.c:805
+#: main.c:814
 msgid "Disable password/SecurID authentication"
 msgstr ""
 
-#: main.c:806
+#: main.c:815
 msgid "Do not require server SSL cert to be valid"
 msgstr ""
 
-#: main.c:807
+#: main.c:816
 msgid "Disable default system certificate authorities"
 msgstr ""
 
-#: main.c:808
+#: main.c:817
 msgid "Do not attempt XML POST authentication"
 msgstr ""
 
-#: main.c:809
+#: main.c:818
 msgid "Do not expect user input; exit if it is required"
 msgstr ""
 
-#: main.c:810
+#: main.c:819
 msgid "Read password from standard input"
 msgstr ""
 
-#: main.c:811
+#: main.c:820
 msgid "Software token type: rsa, totp or hotp"
 msgstr ""
 
-#: main.c:812
+#: main.c:821
 msgid "Software token secret"
 msgstr ""
 
-#: main.c:814
+#: main.c:823
 msgid "(NOTE: libstoken (RSA SecurID) disabled in this build)"
 msgstr ""
 
-#: main.c:817
+#: main.c:826
 msgid "(NOTE: Yubikey OATH disabled in this build)"
 msgstr ""
 
-#: main.c:819
+#: main.c:828
 msgid "Connection retry timeout in seconds"
 msgstr ""
 
-#: main.c:820
+#: main.c:829
 msgid "Server's certificate SHA1 fingerprint"
 msgstr ""
 
-#: main.c:821
+#: main.c:830
 msgid "HTTP header User-Agent: field"
 msgstr ""
 
-#: main.c:822
+#: main.c:831
 msgid "Local hostname to advertise to server"
 msgstr ""
 
-#: main.c:823
+#: main.c:832
 msgid "Use IP when connecting to HOST"
 msgstr ""
 
-#: main.c:824
+#: main.c:833
 msgid "OS type (linux,linux-64,win,...) to report"
 msgstr ""
 
-#: main.c:825
+#: main.c:834
 msgid "Set local port for DTLS datagrams"
 msgstr ""
 
-#: main.c:846
+#: main.c:855
 #, c-format
 msgid "Failed to allocate string\n"
 msgstr ""
 
-#: main.c:907
+#: main.c:916
 #, c-format
 msgid "Failed to get line from config file: %s\n"
 msgstr ""
 
-#: main.c:947
+#: main.c:956
 #, c-format
 msgid "Unrecognised option at line %d: '%s'\n"
 msgstr ""
 
-#: main.c:957
+#: main.c:966
 #, c-format
 msgid "Option '%s' does not take an argument at line %d\n"
 msgstr ""
 
-#: main.c:961
+#: main.c:970
 #, c-format
 msgid "Option '%s' requires an argument at line %d\n"
 msgstr ""
 
-#: main.c:986
+#: main.c:995
 #, c-format
 msgid "Invalid user \"%s\": %s\n"
 msgstr ""
 
-#: main.c:996
+#: main.c:1005
 #, c-format
 msgid "Invalid user ID \"%d\": %s\n"
 msgstr ""
 
-#: main.c:1048
+#: main.c:1057
 #, c-format
 msgid ""
 "WARNING: This version of openconnect was built without iconv\n"
@@ -2321,173 +2368,180 @@ msgid ""
 "         set \"%s\". Expect strangeness.\n"
 msgstr ""
 
-#: main.c:1055
+#: main.c:1064
 #, c-format
 msgid ""
 "WARNING: This version of openconnect is %s but\n"
 "         the libopenconnect library is %s\n"
 msgstr ""
 
-#: main.c:1065
+#: main.c:1074
 #, c-format
 msgid "Failed to allocate vpninfo structure\n"
 msgstr ""
 
-#: main.c:1120
+#: main.c:1129
 #, c-format
 msgid "Cannot use 'config' option inside config file\n"
 msgstr ""
 
-#: main.c:1128
+#: main.c:1137
 #, c-format
 msgid "Cannot open config file '%s': %s\n"
 msgstr ""
 
-#: main.c:1144
+#: main.c:1153
 #, c-format
 msgid "Invalid compression mode '%s'\n"
 msgstr ""
 
-#: main.c:1165
+#: main.c:1174
 #, c-format
 msgid "Missing colon in resolve option\n"
 msgstr ""
 
-#: main.c:1170
+#: main.c:1179
 #, c-format
 msgid "Failed to allocate memory\n"
 msgstr ""
 
-#: main.c:1250 main.c:1259
+#: main.c:1259 main.c:1268
 #, c-format
 msgid "MTU %d too small\n"
 msgstr ""
 
-#: main.c:1289
+#: main.c:1298
 #, c-format
 msgid ""
 "Disabling all HTTP connection re-use due to --no-http-keepalive option.\n"
 "If this helps, please report to <openconnect-devel@lists.infradead.org>.\n"
 msgstr ""
 
-#: main.c:1309
+#: main.c:1304
+#, c-format
+msgid ""
+"The --no-cert-check option was insecure and has been removed.\n"
+"Fix your server's certificate or use --servercert to trust it.\n"
+msgstr ""
+
+#: main.c:1321
 #, c-format
 msgid "Queue length zero not permitted; using 1\n"
 msgstr ""
 
-#: main.c:1323
+#: main.c:1335
 #, c-format
 msgid "OpenConnect version %s\n"
 msgstr ""
 
-#: main.c:1356
+#: main.c:1368
 #, c-format
 msgid "Invalid software token mode \"%s\"\n"
 msgstr ""
 
-#: main.c:1366
+#: main.c:1378
 #, c-format
 msgid "Invalid OS identity \"%s\"\n"
 msgstr ""
 
-#: main.c:1399
+#: main.c:1411
 #, c-format
 msgid "Too many arguments on command line\n"
 msgstr ""
 
-#: main.c:1402
+#: main.c:1414
 #, c-format
 msgid "No server specified\n"
 msgstr ""
 
-#: main.c:1418
+#: main.c:1430
 #, c-format
 msgid "This version of openconnect was built without libproxy support\n"
 msgstr ""
 
-#: main.c:1447
+#: main.c:1459
 #, c-format
 msgid "Error opening cmd pipe\n"
 msgstr ""
 
-#: main.c:1480
+#: main.c:1492
 #, c-format
 msgid "Failed to obtain WebVPN cookie\n"
 msgstr ""
 
-#: main.c:1501
+#: main.c:1513
 #, c-format
 msgid "Creating SSL connection failed\n"
 msgstr ""
 
-#: main.c:1513
+#: main.c:1525
 #, c-format
 msgid "Set up DTLS failed; using SSL instead\n"
 msgstr ""
 
-#: main.c:1533
+#: main.c:1545
 #, c-format
 msgid "Connected as %s%s%s, using %s%s\n"
 msgstr ""
 
-#: main.c:1542
+#: main.c:1554
 msgid "No --script argument provided; DNS and routing are not configured\n"
 msgstr ""
 
-#: main.c:1544
+#: main.c:1556
 msgid "See http://www.infradead.org/openconnect/vpnc-script.html\n"
 msgstr ""
 
-#: main.c:1557
+#: main.c:1569
 #, c-format
 msgid "Failed to open '%s' for write: %s\n"
 msgstr ""
 
-#: main.c:1569
+#: main.c:1581
 #, c-format
 msgid "Continuing in background; pid %d\n"
 msgstr ""
 
-#: main.c:1586
+#: main.c:1598
 msgid "User requested reconnect\n"
 msgstr ""
 
-#: main.c:1594
+#: main.c:1606
 msgid "Cookie was rejected on reconnection; exiting.\n"
 msgstr ""
 
-#: main.c:1598
+#: main.c:1610
 msgid "Session terminated by server; exiting.\n"
 msgstr ""
 
-#: main.c:1602
+#: main.c:1614
 msgid "User cancelled (SIGINT); exiting.\n"
 msgstr ""
 
-#: main.c:1606
+#: main.c:1618
 msgid "User detached from session (SIGHUP); exiting.\n"
 msgstr ""
 
-#: main.c:1610
+#: main.c:1622
 msgid "Unknown error; exiting.\n"
 msgstr ""
 
-#: main.c:1629
+#: main.c:1641
 #, c-format
 msgid "Failed to open %s for write: %s\n"
 msgstr ""
 
-#: main.c:1637
+#: main.c:1649
 #, c-format
 msgid "Failed to write config to %s: %s\n"
 msgstr ""
 
-#: main.c:1696
+#: main.c:1708
 #, c-format
 msgid "Server SSL certificate didn't match: %s\n"
 msgstr ""
 
-#: main.c:1718
+#: main.c:1727
 #, c-format
 msgid ""
 "\n"
@@ -2495,89 +2549,100 @@ msgid ""
 "Reason: %s\n"
 msgstr ""
 
-#: main.c:1724
+#: main.c:1730
+#, c-format
+msgid ""
+"To trust this server in future, perhaps add this to your command line:\n"
+msgstr ""
+
+#: main.c:1731
+#, c-format
+msgid "    --servercert %s\n"
+msgstr ""
+
+#: main.c:1736
 #, c-format
 msgid "Enter '%s' to accept, '%s' to abort; anything else to view: "
 msgstr ""
 
-#: main.c:1725 main.c:1743
+#: main.c:1737 main.c:1755
 msgid "no"
 msgstr ""
 
-#: main.c:1725 main.c:1731
+#: main.c:1737 main.c:1743
 msgid "yes"
 msgstr ""
 
-#: main.c:1752
+#: main.c:1764
 #, c-format
 msgid "Server key hash: %s\n"
 msgstr ""
 
-#: main.c:1786
+#: main.c:1798
 #, c-format
 msgid "Auth choice \"%s\" matches multiple options\n"
 msgstr ""
 
-#: main.c:1789
+#: main.c:1801
 #, c-format
 msgid "Auth choice \"%s\" not available\n"
 msgstr ""
 
-#: main.c:1810
+#: main.c:1822
 msgid "User input required in non-interactive mode\n"
 msgstr ""
 
-#: main.c:1987
+#: main.c:1999
 #, c-format
 msgid "Failed to open token file for write: %s\n"
 msgstr ""
 
-#: main.c:1995
+#: main.c:2007
 #, c-format
 msgid "Failed to write token: %s\n"
 msgstr ""
 
-#: main.c:2041 main.c:2062
+#: main.c:2053 main.c:2074
 #, c-format
 msgid "Soft token string is invalid\n"
 msgstr ""
 
-#: main.c:2044
+#: main.c:2056
 #, c-format
 msgid "Can't open ~/.stokenrc file\n"
 msgstr ""
 
-#: main.c:2047
+#: main.c:2059
 #, c-format
 msgid "OpenConnect was not built with libstoken support\n"
 msgstr ""
 
-#: main.c:2050
+#: main.c:2062
 #, c-format
 msgid "General failure in libstoken\n"
 msgstr ""
 
-#: main.c:2065
+#: main.c:2077
 #, c-format
 msgid "OpenConnect was not built with liboath support\n"
 msgstr ""
 
-#: main.c:2068
+#: main.c:2080
 #, c-format
 msgid "General failure in liboath\n"
 msgstr ""
 
-#: main.c:2079
+#: main.c:2091
 #, c-format
 msgid "Yubikey token not found\n"
 msgstr ""
 
-#: main.c:2082
+#: main.c:2094
 #, c-format
 msgid "OpenConnect was not built with Yubikey support\n"
 msgstr ""
 
-#: main.c:2085
+#: main.c:2097
 #, c-format
 msgid "General Yubikey failure: %s\n"
 msgstr ""
@@ -2592,16 +2657,16 @@ msgstr ""
 msgid "Set up tun device failed\n"
 msgstr ""
 
-#: mainloop.c:263
+#: mainloop.c:264
 msgid "Caller paused the connection\n"
 msgstr ""
 
-#: mainloop.c:271
+#: mainloop.c:272
 #, c-format
 msgid "No work to do; sleeping for %d ms...\n"
 msgstr ""
 
-#: mainloop.c:292
+#: mainloop.c:293
 #, c-format
 msgid "WaitForMultipleObjects failed: %s\n"
 msgstr ""
@@ -2667,7 +2732,7 @@ msgstr ""
 msgid "Generating OATH TOTP token code\n"
 msgstr ""
 
-#: oath.c:568
+#: oath.c:565
 msgid "Generating OATH HOTP token code\n"
 msgstr ""
 
@@ -2799,501 +2864,610 @@ msgstr ""
 msgid "Received non-ESP TLVs (group %d) in ESP negotiation KMP\n"
 msgstr ""
 
-#: oncp.c:569 oncp.c:613 oncp.c:645 oncp.c:771
+#: oncp.c:570 oncp.c:615 oncp.c:647 oncp.c:773
 msgid "Error creating oNCP negotiation request\n"
 msgstr ""
 
-#: oncp.c:654 oncp.c:805
+#: oncp.c:656 oncp.c:807
 msgid "Short write in oNCP negotiation\n"
 msgstr ""
 
-#: oncp.c:666 oncp.c:690
+#: oncp.c:668 oncp.c:692
 #, c-format
 msgid "Read %d bytes of SSL record\n"
 msgstr ""
 
-#: oncp.c:670
+#: oncp.c:672
 #, c-format
 msgid "Unexpected response of size %d after hostname packet\n"
 msgstr ""
 
-#: oncp.c:677
+#: oncp.c:679
 #, c-format
 msgid "Server response to hostname packet is error 0x%02x\n"
 msgstr ""
 
-#: oncp.c:694
+#: oncp.c:696
 msgid "Invalid packet waiting for KMP 301\n"
 msgstr ""
 
-#: oncp.c:707
+#: oncp.c:709
 #, c-format
 msgid "Expected KMP message 301 from server but got %d\n"
 msgstr ""
 
-#: oncp.c:716
+#: oncp.c:718
 #, c-format
 msgid "KMP message 301 from server too large (%d bytes)\n"
 msgstr ""
 
-#: oncp.c:722
+#: oncp.c:724
 #, c-format
 msgid "Got KMP message 301 of length %d\n"
 msgstr ""
 
-#: oncp.c:729
+#: oncp.c:731
 msgid "Failed to read continuation record length\n"
 msgstr ""
 
-#: oncp.c:735
+#: oncp.c:737
 #, c-format
 msgid "Record of additional %d bytes too large; would make %d\n"
 msgstr ""
 
-#: oncp.c:744
+#: oncp.c:746
 #, c-format
 msgid "Failed to read continuation record of length %d\n"
 msgstr ""
 
-#: oncp.c:750
+#: oncp.c:752
 #, c-format
 msgid "Read additional %d bytes of KMP 301 message\n"
 msgstr ""
 
-#: oncp.c:790
+#: oncp.c:792
 msgid "Error negotiating ESP keys\n"
 msgstr ""
 
-#: oncp.c:850
+#: oncp.c:852
 msgid "new incoming"
 msgstr ""
 
-#: oncp.c:851
+#: oncp.c:853
 msgid "new outgoing"
 msgstr ""
 
-#: oncp.c:856
+#: oncp.c:858
 msgid "Ignoring ESP keys since ESP support not available in this build\n"
 msgstr ""
 
-#: oncp.c:876
+#: oncp.c:878
 msgid "Read only 1 byte of oNCP length field\n"
 msgstr ""
 
-#: oncp.c:885
+#: oncp.c:887
 msgid "Server terminated connection (session expired)\n"
 msgstr ""
 
-#: oncp.c:889
+#: oncp.c:891
 #, c-format
 msgid "Server terminated connection (reason: %d)\n"
 msgstr ""
 
-#: oncp.c:895
+#: oncp.c:897
 msgid "Server sent zero-length oNCP record\n"
 msgstr ""
 
-#: oncp.c:986
+#: oncp.c:988
 #, c-format
 msgid "Incoming KMP message %d of size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:989
+#: oncp.c:991
 #, c-format
 msgid "Continuing to process KMP message %d now size %d (got %d)\n"
 msgstr ""
 
-#: oncp.c:1008
+#: oncp.c:1010
 msgid "Unrecognised data packet\n"
 msgstr ""
 
-#: oncp.c:1070
+#: oncp.c:1072
 #, c-format
 msgid "Unknown KMP message %d of size %d:\n"
 msgstr ""
 
-#: oncp.c:1075
+#: oncp.c:1077
 #, c-format
 msgid ".... + %d more bytes unreceived\n"
 msgstr ""
 
-#: oncp.c:1090
+#: oncp.c:1092
 msgid "Packet outgoing:\n"
 msgstr ""
 
-#: oncp.c:1154
+#: oncp.c:1156
 msgid "Sent ESP enable control packet\n"
 msgstr ""
 
-#: openconnect-internal.h:1046 openconnect-internal.h:1054
+#: openconnect-internal.h:1067 openconnect-internal.h:1075
 #, c-format
 msgid "ERROR: %s() called with invalid UTF-8 for '%s' argument\n"
 msgstr ""
 
-#: openssl-esp.c:82
+#: openssl-dtls.c:94
+#, c-format
+msgid "Unable to calculate DTLS overhead for %s\n"
+msgstr ""
+
+#: openssl-dtls.c:216
+#, c-format
+msgid "Failed to create SSL_SESSION ASN.1 for OpenSSL: %s\n"
+msgstr ""
+
+#: openssl-dtls.c:227
+msgid "OpenSSL failed to parse SSL_SESSION ASN.1\n"
+msgstr ""
+
+#: openssl-dtls.c:241
+msgid "Initialise DTLSv1 session failed\n"
+msgstr ""
+
+#: openssl-dtls.c:270
+msgid "PSK callback\n"
+msgstr ""
+
+#: openssl-dtls.c:287
+msgid "Failed to create app-identity extension for OpenSSL\n"
+msgstr ""
+
+#: openssl-dtls.c:352
+msgid "Initialise DTLSv1 CTX failed\n"
+msgstr ""
+
+#: openssl-dtls.c:365
+msgid "Set DTLS CTX version failed\n"
+msgstr ""
+
+#: openssl-dtls.c:382
+msgid "Failed to generate DTLS key\n"
+msgstr ""
+
+#: openssl-dtls.c:402
+msgid "Set DTLS cipher list failed\n"
+msgstr ""
+
+#: openssl-dtls.c:417
+msgid "Not precisely one DTLS cipher\n"
+msgstr ""
+
+#: openssl-dtls.c:439
+#, c-format
+msgid ""
+"SSL_set_session() failed with old protocol version 0x%x\n"
+"Are you using a version of OpenSSL older than 0.9.8m?\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=1751\n"
+"Use the --no-dtls command line option to avoid this message\n"
+msgstr ""
+
+#: openssl-dtls.c:516
+#, c-format
+msgid "Established DTLS connection (using OpenSSL). Ciphersuite %s.\n"
+msgstr ""
+
+#: openssl-dtls.c:553
+msgid "Your OpenSSL is older than the one you built against, so DTLS may fail!"
+msgstr ""
+
+#: openssl-dtls.c:604
+msgid ""
+"This is probably because your OpenSSL is broken\n"
+"See http://rt.openssl.org/Ticket/Display.html?id=2984\n"
+msgstr ""
+
+#: openssl-dtls.c:611
+#, c-format
+msgid "DTLS handshake failed: %d\n"
+msgstr ""
+
+#: openssl-esp.c:90
 msgid "Failed to initialise ESP cipher:\n"
 msgstr ""
 
-#: openssl-esp.c:107
+#: openssl-esp.c:105
 msgid "Failed to initialize ESP HMAC\n"
 msgstr ""
 
-#: openssl-esp.c:158
+#: openssl-esp.c:156
 msgid "Failed to generate random keys for ESP:\n"
 msgstr ""
 
-#: openssl-esp.c:208
+#: openssl-esp.c:206
 msgid "Failed to set up decryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:216
+#: openssl-esp.c:214
 msgid "Failed to decrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:236
+#: openssl-esp.c:234
 msgid "Failed to generate random IV for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:250
+#: openssl-esp.c:248
 msgid "Failed to set up encryption context for ESP packet:\n"
 msgstr ""
 
-#: openssl-esp.c:259
+#: openssl-esp.c:257
 msgid "Failed to encrypt ESP packet:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:42
+#: openssl-pkcs11.c:43
 msgid "Failed to establish libp11 PKCS#11 context:\n"
 msgstr ""
 
-#: openssl-pkcs11.c:48
+#: openssl-pkcs11.c:49
 #, c-format
 msgid "Failed to load PKCS#11 provider module (%s):\n"
 msgstr ""
 
-#: openssl-pkcs11.c:253
+#: openssl-pkcs11.c:269
 msgid "PIN locked\n"
 msgstr ""
 
-#: openssl-pkcs11.c:256
+#: openssl-pkcs11.c:272
 msgid "PIN expired\n"
 msgstr ""
 
-#: openssl-pkcs11.c:259
+#: openssl-pkcs11.c:275
 msgid "Another user already logged in\n"
 msgstr ""
 
-#: openssl-pkcs11.c:263
+#: openssl-pkcs11.c:279
 msgid "Unknown error logging in to PKCS#11 token\n"
 msgstr ""
 
-#: openssl-pkcs11.c:270
+#: openssl-pkcs11.c:286
 #, c-format
 msgid "Logged in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:284
+#: openssl-pkcs11.c:300
 #, c-format
 msgid "Failed to enumerate certs in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:290
+#: openssl-pkcs11.c:306
 #, c-format
 msgid "Found %d certs in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:326 openssl-pkcs11.c:482
+#: openssl-pkcs11.c:342 openssl-pkcs11.c:565
 #, c-format
 msgid "Failed to parse PKCS#11 URI '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:333 openssl-pkcs11.c:492
+#: openssl-pkcs11.c:349 openssl-pkcs11.c:575
 msgid "Failed to enumerate PKCS#11 slots\n"
 msgstr ""
 
-#: openssl-pkcs11.c:367 openssl-pkcs11.c:534
+#: openssl-pkcs11.c:383 openssl-pkcs11.c:617
 #, c-format
 msgid "Logging in to PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:382
+#: openssl-pkcs11.c:393
+#, c-format
+msgid "Failed to find PKCS#11 cert '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:401
 msgid "Certificate X.509 content not fetched by libp11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:393 openssl.c:696
+#: openssl-pkcs11.c:412 openssl.c:741
 msgid "Failed to install certificate in OpenSSL context\n"
 msgstr ""
 
-#: openssl-pkcs11.c:439
+#: openssl-pkcs11.c:458
 #, c-format
 msgid "Failed to enumerate keys in PKCS#11 slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:445
+#: openssl-pkcs11.c:464
 #, c-format
 msgid "Found %d keys in slot '%s'\n"
 msgstr ""
 
-#: openssl-pkcs11.c:563
+#: openssl-pkcs11.c:497
+msgid "Certificate has no public key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:503 openssl-pkcs11.c:526
+msgid "Certificate does not match private key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:506
+msgid "Checking EC key matches cert\n"
+msgstr ""
+
+#: openssl-pkcs11.c:510
+msgid "Failed to allocate signature buffer\n"
+msgstr ""
+
+#: openssl-pkcs11.c:520
+msgid "Failed to sign dummy data to validate EC key\n"
+msgstr ""
+
+#: openssl-pkcs11.c:638
+#, c-format
+msgid "Failed to find PKCS#11 key '%s'\n"
+msgstr ""
+
+#: openssl-pkcs11.c:649
 msgid "Failed to instantiated private key from PKCS#11\n"
 msgstr ""
 
-#: openssl-pkcs11.c:570
+#: openssl-pkcs11.c:678
 msgid "Add key from PKCS#11 failed\n"
 msgstr ""
 
-#: openssl-pkcs11.c:602 openssl-pkcs11.c:608
+#: openssl-pkcs11.c:710 openssl-pkcs11.c:716
 msgid "This version of OpenConnect was built without PKCS#11 support\n"
 msgstr ""
 
-#: openssl.c:134
+#: openssl.c:147
 msgid "Failed to write to SSL socket\n"
 msgstr ""
 
-#: openssl.c:166 openssl.c:218
+#: openssl.c:197 openssl.c:263
 msgid "Failed to read from SSL socket\n"
 msgstr ""
 
-#: openssl.c:247
+#: openssl.c:292
 #, c-format
 msgid "SSL read error %d (server probably closed connection); reconnecting.\n"
 msgstr ""
 
-#: openssl.c:272
+#: openssl.c:317
 #, c-format
 msgid "SSL_write failed: %d\n"
 msgstr ""
 
-#: openssl.c:346
+#: openssl.c:391
 #, c-format
 msgid "Unhandled SSL UI request type %d\n"
 msgstr ""
 
-#: openssl.c:454
+#: openssl.c:499
 #, c-format
 msgid "PEM password too long (%d >= %d)\n"
 msgstr ""
 
-#: openssl.c:487
+#: openssl.c:532
 #, c-format
 msgid "Extra cert from %s: '%s'\n"
 msgstr ""
 
-#: openssl.c:537
+#: openssl.c:582
 msgid "Parse PKCS#12 failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:552
+#: openssl.c:597
 msgid "PKCS#12 contained no certificate!\n"
 msgstr ""
 
-#: openssl.c:561
+#: openssl.c:606
 msgid "PKCS#12 contained no private key!\n"
 msgstr ""
 
-#: openssl.c:566
+#: openssl.c:611
 msgid "PKCS#12"
 msgstr ""
 
-#: openssl.c:584
+#: openssl.c:629
 msgid "Can't load TPM engine.\n"
 msgstr ""
 
-#: openssl.c:590
+#: openssl.c:635
 msgid "Failed to init TPM engine\n"
 msgstr ""
 
-#: openssl.c:600
+#: openssl.c:645
 msgid "Failed to set TPM SRK password\n"
 msgstr ""
 
-#: openssl.c:614
+#: openssl.c:659
 msgid "Failed to load TPM private key\n"
 msgstr ""
 
-#: openssl.c:620
+#: openssl.c:665
 msgid "Add key from TPM failed\n"
 msgstr ""
 
-#: openssl.c:670 openssl.c:817
+#: openssl.c:715 openssl.c:863
 #, c-format
 msgid "Failed to open certificate file %s: %s\n"
 msgstr ""
 
-#: openssl.c:680
+#: openssl.c:725
 msgid "Loading certificate failed\n"
 msgstr ""
 
-#: openssl.c:718
+#: openssl.c:763
 msgid "Failed to process all supporting certs. Trying anyway...\n"
 msgstr ""
 
-#: openssl.c:731
+#: openssl.c:776
 msgid "PEM file"
 msgstr ""
 
-#: openssl.c:760
+#: openssl.c:805
 #, c-format
 msgid "Failed to create BIO for keystore item '%s'\n"
 msgstr ""
 
-#: openssl.c:785
+#: openssl.c:830
 msgid "Loading private key failed (wrong passphrase?)\n"
 msgstr ""
 
-#: openssl.c:791
+#: openssl.c:836
 msgid "Loading private key failed (see above errors)\n"
 msgstr ""
 
-#: openssl.c:840
+#: openssl.c:886
 msgid "Failed to load X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:846
+#: openssl.c:892
 msgid "Failed to use X509 certificate from keystore\n"
 msgstr ""
 
-#: openssl.c:878
+#: openssl.c:924
 msgid "Failed to use private key from keystore\n"
 msgstr ""
 
-#: openssl.c:894
+#: openssl.c:940
 #, c-format
 msgid "Failed to open private key file %s: %s\n"
 msgstr ""
 
-#: openssl.c:913
+#: openssl.c:960 openssl.c:975 openssl.c:996 openssl.c:1062
 msgid "Loading private key failed\n"
 msgstr ""
 
-#: openssl.c:997
+#: openssl.c:1056
 msgid "Failed to convert PKCS#8 to OpenSSL EVP_PKEY\n"
 msgstr ""
 
-#: openssl.c:1008
+#: openssl.c:1073
 #, c-format
 msgid "Failed to identify private key type in '%s'\n"
 msgstr ""
 
-#: openssl.c:1170
+#: openssl.c:1232
 #, c-format
 msgid "Matched DNS altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1177
+#: openssl.c:1239
 #, c-format
 msgid "No match for altname '%s'\n"
 msgstr ""
 
-#: openssl.c:1191
+#: openssl.c:1253
 #, c-format
 msgid "Certificate has GEN_IPADD altname with bogus length %d\n"
 msgstr ""
 
-#: openssl.c:1202 openssl.c:1347
+#: openssl.c:1264 openssl.c:1410
 #, c-format
 msgid "Matched %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1209
+#: openssl.c:1271
 #, c-format
 msgid "No match for %s address '%s'\n"
 msgstr ""
 
-#: openssl.c:1251
+#: openssl.c:1313
 #, c-format
 msgid "URI '%s' has non-empty path; ignoring\n"
 msgstr ""
 
-#: openssl.c:1256
+#: openssl.c:1318
 #, c-format
 msgid "Matched URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1267
+#: openssl.c:1329
 #, c-format
 msgid "No match for URI '%s'\n"
 msgstr ""
 
-#: openssl.c:1282
+#: openssl.c:1344
 #, c-format
 msgid "No altname in peer cert matched '%s'\n"
 msgstr ""
 
-#: openssl.c:1290
+#: openssl.c:1352
 msgid "No subject name in peer cert!\n"
 msgstr ""
 
-#: openssl.c:1310
+#: openssl.c:1372
 msgid "Failed to parse subject name in peer cert\n"
 msgstr ""
 
-#: openssl.c:1317
+#: openssl.c:1379
 #, c-format
 msgid "Peer cert subject mismatch ('%s' != '%s')\n"
 msgstr ""
 
-#: openssl.c:1322 openssl.c:1355
+#: openssl.c:1384 openssl.c:1418
 #, c-format
 msgid "Matched peer certificate subject name '%s'\n"
 msgstr ""
 
-#: openssl.c:1417
+#: openssl.c:1480
 #, c-format
 msgid "Extra cert from cafile: '%s'\n"
 msgstr ""
 
-#: openssl.c:1555
+#: openssl.c:1618
 msgid "Error in client cert notAfter field\n"
 msgstr ""
 
-#: openssl.c:1568
+#: openssl.c:1631
 msgid "<error>"
 msgstr ""
 
-#: openssl.c:1620
+#: openssl.c:1686
 msgid "Create TLSv1 CTX failed\n"
 msgstr ""
 
-#: openssl.c:1675
+#: openssl.c:1705
+msgid "SSL certificate and key do not match\n"
+msgstr ""
+
+#: openssl.c:1750
 #, c-format
 msgid "Failed to read certs from CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1708
+#: openssl.c:1783
 #, c-format
 msgid "Failed to open CA file '%s'\n"
 msgstr ""
 
-#: openssl.c:1768
+#: openssl.c:1843
 msgid "SSL connection failure\n"
 msgstr ""
 
-#: openssl.c:1929
+#: openssl.c:2004
 msgid "Failed to calculate OATH HMAC\n"
 msgstr ""
 
-#: script.c:96
+#: script.c:102
 #, c-format
 msgid "Discard bad split include: \"%s\"\n"
 msgstr ""
 
-#: script.c:100
+#: script.c:106
 #, c-format
 msgid "Discard bad split exclude: \"%s\"\n"
 msgstr ""
 
-#: script.c:500 script.c:548
+#: script.c:513 script.c:561
 #, c-format
 msgid "Failed to spawn script '%s' for %s: %s\n"
 msgstr ""
 
-#: script.c:555
+#: script.c:568
 #, c-format
 msgid "Script '%s' exited abnormally (%x)\n"
 msgstr ""
 
-#: script.c:563
+#: script.c:576
 #, c-format
 msgid "Script '%s' returned error %d\n"
 msgstr ""
@@ -3590,83 +3764,95 @@ msgstr ""
 msgid "Generating RSA token code\n"
 msgstr ""
 
-#: tun-win32.c:75
+#: tun-win32.c:76
 msgid "Error accessing registry key for network adapters\n"
 msgstr ""
 
-#: tun-win32.c:138
+#: tun-win32.c:139
 #, c-format
 msgid "Ignoring non-matching TAP interface \"%s\"\n"
 msgstr ""
 
-#: tun-win32.c:153
+#: tun-win32.c:154
 msgid "No Windows-TAP adapters found. Is the driver installed?\n"
 msgstr ""
 
-#: tun-win32.c:171
+#: tun-win32.c:186
+#, c-format
+msgid ""
+"GetAdapterIndex() failed: %s\n"
+"Falling back to GetAdaptersInfo()\n"
+msgstr ""
+
+#: tun-win32.c:200
+#, c-format
+msgid "GetAdaptersInfo() failed: %s\n"
+msgstr ""
+
+#: tun-win32.c:231
 #, c-format
 msgid "Failed to open %s\n"
 msgstr ""
 
-#: tun-win32.c:176
+#: tun-win32.c:236
 #, c-format
 msgid "Opened tun device %s\n"
 msgstr ""
 
-#: tun-win32.c:184
+#: tun-win32.c:244
 #, c-format
 msgid "Failed to obtain TAP driver version: %s\n"
 msgstr ""
 
-#: tun-win32.c:190
+#: tun-win32.c:250
 #, c-format
 msgid "Error: TAP-Windows driver v9.9 or greater is required (found %ld.%ld)\n"
 msgstr ""
 
-#: tun-win32.c:207
+#: tun-win32.c:271
 #, c-format
 msgid "Failed to set TAP IP addresses: %s\n"
 msgstr ""
 
-#: tun-win32.c:219
+#: tun-win32.c:283
 #, c-format
 msgid "Failed to set TAP media status: %s\n"
 msgstr ""
 
-#: tun-win32.c:249
+#: tun-win32.c:315
 msgid "TAP device aborted connectivity. Disconnecting.\n"
 msgstr ""
 
-#: tun-win32.c:254
+#: tun-win32.c:320
 #, c-format
 msgid "Failed to read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:268
+#: tun-win32.c:334
 #, c-format
 msgid "Failed to complete read from TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:291
+#: tun-win32.c:357
 #, c-format
 msgid "Wrote %ld bytes to tun\n"
 msgstr ""
 
-#: tun-win32.c:301
+#: tun-win32.c:367
 msgid "Waiting for tun write...\n"
 msgstr ""
 
-#: tun-win32.c:304
+#: tun-win32.c:370
 #, c-format
 msgid "Wrote %ld bytes to tun after waiting\n"
 msgstr ""
 
-#: tun-win32.c:311
+#: tun-win32.c:377
 #, c-format
 msgid "Failed to write to TAP device: %s\n"
 msgstr ""
 
-#: tun-win32.c:338
+#: tun-win32.c:404
 msgid "Spawning tunnel scripts is not yet supported on Windows\n"
 msgstr ""