Index: src/Browser/WebCore/platform/network/ekioh/ResourceHandleManager525.cpp
===================================================================
--- src.orig/Browser/WebCore/platform/network/ekioh/ResourceHandleManager525.cpp
+++ src/Browser/WebCore/platform/network/ekioh/ResourceHandleManager525.cpp
@@ -64,6 +64,12 @@ namespace WebCore {
 
 ResourceHandleManager* ResourceHandleManager::m_instance = 0;
 
+static const char * CIPHER_LIST  = "TLSv1:SSLv3:-SSLv2:-aNULL:RSA:-EXP:-NULL:+HIGH:-MEDIUM:-LOW:-MD5:-3DES";
+static const char * CERT_FILE = "/etc/tls/webkit/cert.der";
+static const char * KEY_FILE = "/etc/tls/webkit/key.der";
+static const char * CA_BUNDLE_FILE = "/etc/tls/webkit/ca-bundle.pem";
+static const char * CA_PATH = "/etc/tls/webkit/certs/";
+
 static int updateSocketStatusCallback(
         CURL *easyHandle,
         curl_socket_t sockfd,
@@ -545,6 +551,26 @@ void ResourceHandleManager::startJob(Res
     // multi api, so would this have any benefit?
     ResourceHandleInternal* d = job->getInternal();
 
+    int secureMode = atoi(getenv("http_secure_mode"));
+    if (secureMode > 2) {
+      // Set to the wrong mode?
+      fprintf(stderr, "Wrong http_secure_mode? set it to 0\n");
+      secureMode = 0;
+    }
+
+    // fprintf(stderr, "Set http secure mode to %d\n", secureMode);
+    if (secureMode != 0) {
+      //http_secure_mode: 
+      //0="http and https" 1="https only" 2="https with mutual authentication only"
+      DeprecatedString protocol = job->request().url().protocol();
+      if (protocol.lower() == "http") {
+        fprintf(stderr, "Http secure mode is set to %d\n", secureMode);
+        fprintf(stderr, "normal http access is not allowed\n");
+        job->cancel();
+        return;
+      }
+    }
+
     d->m_handle = curl_easy_init();
     curl_easy_setopt(d->m_handle, CURLOPT_PRIVATE, job);
     curl_easy_setopt(d->m_handle, CURLOPT_ERRORBUFFER, m_curlErrorBuffer);
@@ -567,6 +593,40 @@ void ResourceHandleManager::startJob(Res
     d->m_url = job->request().url().deprecatedString();
     curl_easy_setopt(d->m_handle, CURLOPT_URL, d->m_url.ascii());
 
+    // fprintf(stderr, "Enabling curl verbose (may break logging)\n");
+    // curl_easy_setopt(d->m_handle, CURLOPT_VERBOSE, 1);
+
+    // https setting
+    curl_easy_setopt(d->m_handle, CURLOPT_SSL_VERIFYHOST, 0);
+    if (access(CA_BUNDLE_FILE, R_OK) == 0) {
+      curl_easy_setopt(d->m_handle, CURLOPT_CAINFO, CA_BUNDLE_FILE);
+    } else {
+      curl_easy_setopt(d->m_handle, CURLOPT_CAINFO, NULL);
+    }
+    if (access(CA_PATH, R_OK) == 0) {
+      curl_easy_setopt(d->m_handle, CURLOPT_CAPATH, CA_PATH);
+    } else {
+      curl_easy_setopt(d->m_handle, CURLOPT_CAPATH, NULL);
+    }
+    if (access(CERT_FILE, R_OK) == 0) {
+      curl_easy_setopt(d->m_handle, CURLOPT_SSLCERT, CERT_FILE);
+      curl_easy_setopt(d->m_handle, CURLOPT_SSLCERTTYPE, "DER");
+    }
+    if (access(KEY_FILE, R_OK) == 0) {
+      curl_easy_setopt(d->m_handle, CURLOPT_SSLKEY, KEY_FILE);
+      curl_easy_setopt(d->m_handle, CURLOPT_SSLKEYTYPE, "DER");
+    }
+    if (secureMode == 2) {
+      // https with mutual authentication only
+      curl_easy_setopt(d->m_handle, CURLOPT_SSL_CIPHER_LIST, CIPHER_LIST);
+      curl_easy_setopt(d->m_handle, CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
+      //curl_easy_setopt(d->m_handle, CURLOPT_SSL_VERIFYPEER, 1L);
+    }
+    else if (secureMode == 1) {
+      // https with server side certificate is ok
+      //curl_easy_setopt(d->m_handle, CURLOPT_SSL_VERIFYPEER, 0);
+    }
+
     setProxy(job->request(), d->m_handle);
 
     String cs = cookies(0, d->m_url);
Index: src/Browser/WebCore/platform/network/ekioh/ResourceHandleEkioh.cpp
===================================================================
--- src.orig/Browser/WebCore/platform/network/ekioh/ResourceHandleEkioh.cpp
+++ src/Browser/WebCore/platform/network/ekioh/ResourceHandleEkioh.cpp
@@ -57,6 +57,10 @@
   } while (false)
 
 namespace {
+
+  static const char * CA_BUNDLE_FILE = "/etc/tls/webkit/ca-bundle.pem";
+  static const char * CA_PATH = "/etc/tls/webkit/certs/";
+
   static bool isPortAllowed(const WebCore::ResourceRequest& request)
   {
     // List from: http://www.mozilla.org/projects/netlib/PortBanning.html
@@ -350,7 +354,16 @@ void ResourceHandle::loadResourceSynchro
   CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_FOLLOWLOCATION, 1));
   CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_HTTPAUTH, CURLAUTH_ANY));
   CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_SHARE, shareHandle));
-  CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_CAINFO, "ca-bundle.crt"));
+  if (access(CA_BUNDLE_FILE, R_OK) == 0) {
+    CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_CAINFO, CA_BUNDLE_FILE));
+  } else {
+    CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_CAINFO, NULL));
+  }
+  if (access(CA_PATH, R_OK) == 0) {
+    CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_CAPATH, CA_PATH));
+  } else {
+    CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_CAPATH, NULL));
+  }
   // enable gzip and deflate through Accept-Encoding:
   CURL_CALL(curl_easy_setopt(curlHandle, CURLOPT_ENCODING, ""));
 
