 +                }
 +                obstcp_client_accum_init(&mObsAccum, &mObsContext);
 +                obstcp_rbuf_client_init(&mObsRBuf, &mObsContext);
++            } else if (a && tlsport) {
++              fprintf(stderr, "Using TLS alternative transport");
++              mTLSTransport = 1;
++              mPort = tlsport;
++              mNetAddr.inet.port = htons(tlsport);
 +            }
 +        }
 +    }
 +
-     status = PR_Connect(fd, &mNetAddr, NS_SOCKET_CONNECT_TIMEOUT);
-     if (status == PR_SUCCESS) {
+     //
+     // create new socket fd, push io layers, etc.
+     //
+@@ -1108,6 +1325,7 @@ nsSocketTransport::InitiateSocket()
+     PRBool usingSSL;
+ 
+     rv = BuildSocket(fd, proxyTransparent, usingSSL);
++    fprintf(stderr, "BuildSocket usingSSL:%d\n", usingSSL);
+     if (NS_FAILED(rv)) {
+         LOG(("  BuildSocket failed [rv=%x]\n", rv));
+         return rv;
+@@ -1160,6 +1378,12 @@ nsSocketTransport::InitiateSocket()
          // 
          // we are connected!
          //

 };
 
 //-----------------------------------------------------------------------------
@@ -224,6 +230,10 @@ private:
     nsCOMPtr<nsICancelable> mDNSRequest;
     nsCOMPtr<nsIDNSRecord>  mDNSRecord;
     PRNetAddr               mNetAddr;
+    bool                    mObfuscation;
+    struct obstcp_client_ctx mObsContext;
+    struct obstcp_rbuf      mObsRBuf;
+    struct obstcp_accum     mObsAccum;

 
     PR_STATIC_CALLBACK(void) ThreadFunc(void *);
 
diff --git a/netwerk/socket/base/nsISSLSocketControl.idl b/netwerk/socket/base/nsISSLSocketControl.idl
index 3fede66..343aa7b 100644
--- a/netwerk/socket/base/nsISSLSocketControl.idl
+++ b/netwerk/socket/base/nsISSLSocketControl.idl
@@ -45,6 +45,7 @@ interface nsIInterfaceRequestor;
 [scriptable, uuid(a092097c-8386-4f1b-97b1-90eb70008c2d)]
 interface nsISSLSocketControl : nsISupports {
     attribute nsIInterfaceRequestor     notificationCallbacks;
+    attribute boolean ignoreAllCertErrors;
 
     void proxyStartSSL();
     void StartTLS();
diff --git a/security/manager/ssl/src/nsNSSIOLayer.cpp b/security/manager/ssl/src/nsNSSIOLayer.cpp
index d7cc583..55e20c1 100644
--- a/security/manager/ssl/src/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/src/nsNSSIOLayer.cpp
@@ -201,7 +201,8 @@ PRBool nsSSLSocketThreadData::ensure_buffer_size(PRInt32 amount)
 }
 
 nsNSSSocketInfo::nsNSSSocketInfo()
-  : mFd(nsnull),
+  : mIgnoreAllCertErrors(0),
+    mFd(nsnull),
     mBlockingState(blocking_state_unknown),
     mSecurityState(nsIWebProgressListener::STATE_IS_INSECURE),
     mSubRequestsHighSecurity(0),
@@ -331,6 +332,20 @@ nsNSSSocketInfo::SetNotificationCallbacks(nsIInterfaceRequestor* aCallbacks)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsNSSSocketInfo::GetIgnoreAllCertErrors(PRBool *val) {
+  *val = mIgnoreAllCertErrors;
+  fprintf(stderr, "Getting IgnoreAllCertErrors: %d\n", mIgnoreAllCertErrors);
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsNSSSocketInfo::SetIgnoreAllCertErrors(PRBool val) {
+  mIgnoreAllCertErrors = val;
+  fprintf(stderr, "Setting IgnoreAllCertErrors: %d\n", val);
+  return NS_OK;
+}
+
 nsresult
 nsNSSSocketInfo::EnsureDocShellDependentStuffKnown()
 {
@@ -2843,6 +2858,13 @@ nsNSSBadCertHandler(void *arg, PRFileDesc *sslSocket)
   if (nsSSLThread::exitRequested())
     return cancel_and_failure(infoObject);
 
+  fprintf(stderr, "Starting cert error processing\n");
+  PRBool ignore_errors;
+  if (NS_SUCCEEDED(infoObject->GetIgnoreAllCertErrors(&ignore_errors)) &&
+      ignore_errors)
+    return SECSuccess;
+  fprintf(stderr, "  ... continuing\n");
+
   CERTCertificate *peerCert = nsnull;
   CERTCertificateCleaner peerCertCleaner(peerCert);
   peerCert = SSL_PeerCertificate(sslSocket);
diff --git a/security/manager/ssl/src/nsNSSIOLayer.h b/security/manager/ssl/src/nsNSSIOLayer.h
index b530d98..ff5f18b 100644
--- a/security/manager/ssl/src/nsNSSIOLayer.h
+++ b/security/manager/ssl/src/nsNSSIOLayer.h
@@ -199,6 +199,7 @@ public:
   
 protected:
   nsCOMPtr<nsIInterfaceRequestor> mCallbacks;
+  PRBool mIgnoreAllCertErrors;
   PRFileDesc* mFd;
   nsCOMPtr<nsIX509Cert> mCert;
   nsCOMPtr<nsIX509Cert> mPreviousCert; // DocShellDependent
diff --git a/toolkit/library/Makefile.in b/toolkit/library/Makefile.in
index 7b00f11..d30494c 100644
--- a/toolkit/library/Makefile.in
