19 files changed, 1033 insertions, 0 deletions
diff --git a/dummyserver/__init__.py b/dummyserver/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/dummyserver/__init__.py
diff --git a/dummyserver/certs/README.rst b/dummyserver/certs/README.rst
new file mode 100644
index 0000000..4fb6632
--- /dev/null
+++ b/dummyserver/certs/README.rst
@@ -0,0 +1,24 @@
+Creating a new SAN-less CRT
+---------------------------
+
+(Instructions lifted from Heroku_)
+
+1. Generate a new CSR::
+   
+       openssl req -new -key server.key -out server.new.csr -nodes -days 10957
+
+2. Generate a new CRT::
+
+       openssl x509 -req -in server.new.csr -signkey server.key -out server.new.crt -days 10957
+
+Creating a new PEM file with your new CRT
+-----------------------------------------
+
+1. Concatenate the ``crt`` and ``key`` files into one::
+
+       cat server.new.crt server.key > cacert.new.pem
+
+
+:Last Modified: 1 Nov 2014
+
+.. _Heroku: https://devcenter.heroku.com/articles/ssl-certificate-self
diff --git a/dummyserver/certs/cacert.key b/dummyserver/certs/cacert.key
new file mode 100644
index 0000000..fc8be6e
--- /dev/null
+++ b/dummyserver/certs/cacert.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQDKz8a9X2SfNms9TffyNaFO/K42fAjUI1dAM1G8TVoj0a81ay7W
+z4R7V1zfjXFT/WoRW04Y6xek0bff0OtsW+AriooUy7+pPYnrchpAW0p7hPjH1DIB
+Vab01CJMhQ24er92Q1dF4WBv4yKqEaV1IYz1cvqvCCJgAbsWn1I8Cna1lwIDAQAB
+AoGAPpkK+oBrCkk9qFpcYUH0W/DZxK9b+j4+O+6bF8e4Pr4FmjNO7bZ3aap5W/bI
+N+hLyLepzz8guRqR6l8NixCAi+JiVW/agh5o4Jrek8UJWQamwSL4nJ36U3Iw/l7w
+vcN1txfkpsA2SB9QFPGfDKcP3+IZMOZ7uFLzk/gzgLYiCEECQQD+M5Lj+e/sNBkb
+XeIBxWIrPfEeIkk4SDkqImzDjq1FcfxZkvfskqyJgUvcLe5hb+ibY8jqWvtpvFTI
+5v/tzHvPAkEAzD8fNrGz8KiAVTo7+0vrb4AebAdSLZUvbp0AGs5pXUAuQx6VEgz8
+opNKpZjBwAFsZKlwhgDqaChiAt9aKUkzuQJBALlai9I2Dg7SkjgVRdX6wjE7slRB
+tdgXOa+SeHJD1+5aRiJeeu8CqFJ/d/wtdbOQsTCVGwxfmREpZT00ywrvXpsCQQCU
+gs1Kcrn5Ijx2PCrDFbfyUkFMoaIiXNipYGVkGHRKhtFcoo8YGfNUry7W7BTtbNuI
+8h9MgLvw0nQ5zHf9jymZAkEA7o4uA6XSS1zUqEQ55bZRFHcz/99pLH35G906iwVb
+d5rd1Z4Cf5s/91o5gwL6ZP2Ig34CCn+NSL4avgz6K0VUaA==
+-----END RSA PRIVATE KEY-----
diff --git a/dummyserver/certs/cacert.no_san.pem b/dummyserver/certs/cacert.no_san.pem
new file mode 100644
index 0000000..6df351b
--- /dev/null
+++ b/dummyserver/certs/cacert.no_san.pem
@@ -0,0 +1,31 @@
+-----BEGIN CERTIFICATE-----
+MIIChzCCAfACCQCmk6is+6REjDANBgkqhkiG9w0BAQUFADCBhzELMAkGA1UEBhMC
+Q0ExEDAOBgNVBAgMB09udGFyaW8xEDAOBgNVBAcMB09udGFyaW8xHzAdBgNVBAoM
+FlNoYXpvdydzIFVzZWQgQ2FycyBJbmMxEjAQBgNVBAMMCWxvY2FsaG9zdDEfMB0G
+CSqGSIb3DQEJARYQc2hhem93QGdtYWlsLmNvbTAeFw0xNDEyMDMyMjE3MjVaFw00
+NDEyMDIyMjE3MjVaMIGHMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEQ
+MA4GA1UEBwwHT250YXJpbzEfMB0GA1UECgwWU2hhem93J3MgVXNlZCBDYXJzIElu
+YzESMBAGA1UEAwwJbG9jYWxob3N0MR8wHQYJKoZIhvcNAQkBFhBzaGF6b3dAZ21h
+aWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXe3FqmCWvP8XPxqtT
++0bfL1Tvzvebi46k0WIcUV8bP3vyYiSRXG9ALmyzZH4GHY9UVs4OEDkCMDOBSezB
+0y9ai/9doTNcaictdEBu8nfdXKoTtzrn+VX4UPrkH5hm7NQ1fTQuj1MR7yBCmYqN
+3Q2Q+Efuujyx0FwBzAuy1aKYuwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHI/m9/O
+bVR3zBOJZUKlHzTRvfYbYhhfrrcQlbwhjKqNyZcQTL/bJdtQSL19g3ftC5wZPI+y
+66R24MqGmRcv5kT32HcuIK1Xhx4nDqTqnTNvGkaIh5CqS4DEP+iqtwDoEbQt8DwL
+ejKtvZlyQRKFPTMtmv4VsTIHeVOAj+pXn595
+-----END CERTIFICATE-----
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQDXe3FqmCWvP8XPxqtT+0bfL1Tvzvebi46k0WIcUV8bP3vyYiSR
+XG9ALmyzZH4GHY9UVs4OEDkCMDOBSezB0y9ai/9doTNcaictdEBu8nfdXKoTtzrn
++VX4UPrkH5hm7NQ1fTQuj1MR7yBCmYqN3Q2Q+Efuujyx0FwBzAuy1aKYuwIDAQAB
+AoGBANOGBM6bbhq7ImYU4qf8+RQrdVg2tc9Fzo+yTnn30sF/rx8/AiCDOV4qdGAh
+HKjKKaGj2H/rotqoEFcxBy05LrgJXxydBP72e9PYhNgKOcSmCQu4yALIPEXfKuIM
+zgAErHVJ2l79fif3D4hzNyz+u5E1A9n3FG9cgaJSiYP8IG2RAkEA82GZ8rBkSGQQ
+ZQ3oFuzPAAL21lbj8D0p76fsCpvS7427DtZDOjhOIKZmaeykpv+qSzRraqEqjDRi
+S4kjQvwh6QJBAOKniZ+NDo2lSpbOFk+XlmABK1DormVpj8KebHEZYok1lRI+WiX9
+Nnoe9YLgix7++6H5SBBCcTB4HvM+5A4BuwMCQQChcX/eZbXP81iQwB3Rfzp8xnqY
+icDf7qKvz9Ma4myU7Y5E9EpaB1mD/P14jDpYcMW050vNyqTfpiwB8TFL0NZpAkEA
+02jkFH9UyMgZV6qo4tqI98l/ZrtyF8OrxSNSEPhVkZf6EQc5vN9/lc8Uv1vESEgb
+3AwRrKDcxRH2BHtv6qSwkwJAGjqnkIcEkA75r1e55/EF2chcZW1+tpwKupE8CtAH
+VXGd5DVwt4cYWkLUj2gF2fJbV97uu2MAg5CFDb+vQ6p5eA==
+-----END RSA PRIVATE KEY-----
diff --git a/dummyserver/certs/cacert.pem b/dummyserver/certs/cacert.pem
new file mode 100644
index 0000000..38d32dc
--- /dev/null
+++ b/dummyserver/certs/cacert.pem
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDzDCCAzWgAwIBAgIJALPrscov4b/jMA0GCSqGSIb3DQEBBQUAMIGBMQswCQYD
+VQQGEwJGSTEOMAwGA1UECBMFZHVtbXkxDjAMBgNVBAcTBWR1bW15MQ4wDAYDVQQK
+EwVkdW1teTEOMAwGA1UECxMFZHVtbXkxETAPBgNVBAMTCFNuYWtlT2lsMR8wHQYJ
+KoZIhvcNAQkBFhBkdW1teUB0ZXN0LmxvY2FsMB4XDTExMTIyMjA3NTYxNVoXDTIx
+MTIxOTA3NTYxNVowgYExCzAJBgNVBAYTAkZJMQ4wDAYDVQQIEwVkdW1teTEOMAwG
+A1UEBxMFZHVtbXkxDjAMBgNVBAoTBWR1bW15MQ4wDAYDVQQLEwVkdW1teTERMA8G
+A1UEAxMIU25ha2VPaWwxHzAdBgkqhkiG9w0BCQEWEGR1bW15QHRlc3QubG9jYWww
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMrPxr1fZJ82az1N9/I1oU78rjZ8
+CNQjV0AzUbxNWiPRrzVrLtbPhHtXXN+NcVP9ahFbThjrF6TRt9/Q62xb4CuKihTL
+v6k9ietyGkBbSnuE+MfUMgFVpvTUIkyFDbh6v3ZDV0XhYG/jIqoRpXUhjPVy+q8I
+ImABuxafUjwKdrWXAgMBAAGjggFIMIIBRDAdBgNVHQ4EFgQUGXd/I2JiQllF+3Wd
+x3NyBLszCi0wgbYGA1UdIwSBrjCBq4AUGXd/I2JiQllF+3Wdx3NyBLszCi2hgYek
+gYQwgYExCzAJBgNVBAYTAkZJMQ4wDAYDVQQIEwVkdW1teTEOMAwGA1UEBxMFZHVt
+bXkxDjAMBgNVBAoTBWR1bW15MQ4wDAYDVQQLEwVkdW1teTERMA8GA1UEAxMIU25h
+a2VPaWwxHzAdBgkqhkiG9w0BCQEWEGR1bW15QHRlc3QubG9jYWyCCQCz67HKL+G/
+4zAPBgNVHRMBAf8EBTADAQH/MBEGCWCGSAGG+EIBAQQEAwIBBjAJBgNVHRIEAjAA
+MCsGCWCGSAGG+EIBDQQeFhxUaW55Q0EgR2VuZXJhdGVkIENlcnRpZmljYXRlMA4G
+A1UdDwEB/wQEAwICBDANBgkqhkiG9w0BAQUFAAOBgQBnnwtO8onsyhGOvS6cS8af
+IRZyAXgouuPeP3Zrf5W80iZcV23u94969sPEIsD8Ujv5u0hUSrToGl4ahOMEOFNL
+R5ndQOkh3VsepJnoE+RklZzbHWxU8onWlVzsNBFbclxidzaU3UHmdgXJAJL5nVSd
+Zpn44QSS0UXsaC0mBimVNw==
+-----END CERTIFICATE-----
diff --git a/dummyserver/certs/client.csr b/dummyserver/certs/client.csr
new file mode 100644
index 0000000..703d351
--- /dev/null
+++ b/dummyserver/certs/client.csr
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIID1TCCAz6gAwIBAgIBAjANBgkqhkiG9w0BAQUFADCBgTELMAkGA1UEBhMCRkkx
+DjAMBgNVBAgTBWR1bW15MQ4wDAYDVQQHEwVkdW1teTEOMAwGA1UEChMFZHVtbXkx
+DjAMBgNVBAsTBWR1bW15MREwDwYDVQQDEwhTbmFrZU9pbDEfMB0GCSqGSIb3DQEJ
+ARYQZHVtbXlAdGVzdC5sb2NhbDAeFw0xMTEyMjIwNzU5NTlaFw0yMTEyMTgwNzU5
+NTlaMH8xCzAJBgNVBAYTAkZJMQ4wDAYDVQQIEwVkdW1teTEOMAwGA1UEBxMFZHVt
+bXkxDjAMBgNVBAoTBWR1bW15MQ4wDAYDVQQLEwVkdW1teTEPMA0GA1UEAxMGY2xp
+ZW50MR8wHQYJKoZIhvcNAQkBFhBjbGllbnRAbG9jYWxob3N0MIGfMA0GCSqGSIb3
+DQEBAQUAA4GNADCBiQKBgQDaITA/XCzviqjex+lJJP+pgmQQ+ncUf+PDaFw86kWh
+cWuI2eSBVaIaP6SsxYgIODQTjqYGjRogsd1Nvx3gRdIMEagTfVQyVwfDfNp8aT8v
+SY/wDYFjsD07asmjGvwiu0sLp4t/tMz+x5ELlU4+hGnmPInH6hLK150DqgbNmJus
+3wIDAQABo4IBXDCCAVgwCQYDVR0TBAIwADARBglghkgBhvhCAQEEBAMCBLAwKwYJ
+YIZIAYb4QgENBB4WHFRpbnlDQSBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0O
+BBYEFG71FCU2yisH1GyrcqYaPKVeTWxBMIG2BgNVHSMEga4wgauAFBl3fyNiYkJZ
+Rft1ncdzcgS7MwotoYGHpIGEMIGBMQswCQYDVQQGEwJGSTEOMAwGA1UECBMFZHVt
+bXkxDjAMBgNVBAcTBWR1bW15MQ4wDAYDVQQKEwVkdW1teTEOMAwGA1UECxMFZHVt
+bXkxETAPBgNVBAMTCFNuYWtlT2lsMR8wHQYJKoZIhvcNAQkBFhBkdW1teUB0ZXN0
+LmxvY2FsggkAs+uxyi/hv+MwCQYDVR0SBAIwADAbBgNVHREEFDASgRBjbGllbnRA
+bG9jYWxob3N0MAsGA1UdDwQEAwIFoDANBgkqhkiG9w0BAQUFAAOBgQDEwZmp3yE8
+R4U9Ob/IeEo6O3p0T4o7GNvufGksM/mELmzyC+Qh/Ul6fNn+IhdKWpo61sMZou+n
+eOufXVouc8dGhQ1Qi5s0i51d/ouhfYNs+AGRcpwEieVjZhgE1XfrNwvvjIx3yPtK
+m9LSmCtVKcTWqOHQywKn+G83a+7bsh835Q==
+-----END CERTIFICATE-----
diff --git a/dummyserver/certs/client.key b/dummyserver/certs/client.key
new file mode 100644
index 0000000..0d1c343
--- /dev/null
+++ b/dummyserver/certs/client.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQDaITA/XCzviqjex+lJJP+pgmQQ+ncUf+PDaFw86kWhcWuI2eSB
+VaIaP6SsxYgIODQTjqYGjRogsd1Nvx3gRdIMEagTfVQyVwfDfNp8aT8vSY/wDYFj
+sD07asmjGvwiu0sLp4t/tMz+x5ELlU4+hGnmPInH6hLK150DqgbNmJus3wIDAQAB
+AoGAKMMg+AYqo4z+57rl/nQ6jpu+RWn4zMzlbEPZUMzavEOsu8M0L3MoOs1/4YV8
+WUTffnQe1ISTyF5Uo82+MIX7rUtfJITFSQrIWe7AGdm6Nir8TQQ7fD97modXyAUx
+69I9SQjQlseg5PCRCp/DfcBncvHeYuf8gAJK5FfC1VW1cQECQQDvzFNoGrwnsrtm
+4gj1Kt0c20jkIYFN6iQ6Sjs/1fk1cXDeWzjPaa92zF+i+02Ma/eWJ0ZVrhisw6sv
+zxGp+ByBAkEA6N4SpuGWytJqCRfwenQZ4Oa8mNcVo5ulGf/eUHVXvHewWxQ7xWRi
+iWUj/z1byR9+yno8Yfd04kaNCPYN/ICZXwJAAf5//xCh2e6pkkx06J0Ho7LLI2KH
+8b7tuDJf1cMQxHoCB0dY7JijZeiDLxbJ6U4IjA4djp7ZA67I4KfnLLOsgQJARLZS
+dp+WKR7RXwGLWfasNCqhd8/veKlSnEtdxAv76Ya/qQBdaq9mS/hmGMh4Lu52MTTE
+YHvuJ159+yjvk5Q2rQJABjlU1+GZqwv/7QM7GxfJO+GPI4PHv5Yji5s7LLu2c6dL
+XY2XiTHQL9PnPrKp3+qDDzxjyej30lfz4he6E5pI+g==
+-----END RSA PRIVATE KEY-----
diff --git a/dummyserver/certs/client.pem b/dummyserver/certs/client.pem
new file mode 100644
index 0000000..29aea38
--- /dev/null
+++ b/dummyserver/certs/client.pem
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqDCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgTELMAkGA1UEBhMCRkkx
+DjAMBgNVBAgTBWR1bW15MQ4wDAYDVQQHEwVkdW1teTEOMAwGA1UEChMFZHVtbXkx
+DjAMBgNVBAsTBWR1bW15MREwDwYDVQQDEwhTbmFrZU9pbDEfMB0GCSqGSIb3DQEJ
+ARYQZHVtbXlAdGVzdC5sb2NhbDAeFw0xMTEyMjIwNzU4NDBaFw0yMTEyMTgwNzU4
+NDBaMGExCzAJBgNVBAYTAkZJMQ4wDAYDVQQIEwVkdW1teTEOMAwGA1UEBxMFZHVt
+bXkxDjAMBgNVBAoTBWR1bW15MQ4wDAYDVQQLEwVkdW1teTESMBAGA1UEAxMJbG9j
+YWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXe3FqmCWvP8XPxqtT
++0bfL1Tvzvebi46k0WIcUV8bP3vyYiSRXG9ALmyzZH4GHY9UVs4OEDkCMDOBSezB
+0y9ai/9doTNcaictdEBu8nfdXKoTtzrn+VX4UPrkH5hm7NQ1fTQuj1MR7yBCmYqN
+3Q2Q+Efuujyx0FwBzAuy1aKYuwIDAQABo4IBTTCCAUkwCQYDVR0TBAIwADARBglg
+hkgBhvhCAQEEBAMCBkAwKwYJYIZIAYb4QgENBB4WHFRpbnlDQSBHZW5lcmF0ZWQg
+Q2VydGlmaWNhdGUwHQYDVR0OBBYEFBvnSuVKLNPEFMAFqHw292vGHGJSMIG2BgNV
+HSMEga4wgauAFBl3fyNiYkJZRft1ncdzcgS7MwotoYGHpIGEMIGBMQswCQYDVQQG
+EwJGSTEOMAwGA1UECBMFZHVtbXkxDjAMBgNVBAcTBWR1bW15MQ4wDAYDVQQKEwVk
+dW1teTEOMAwGA1UECxMFZHVtbXkxETAPBgNVBAMTCFNuYWtlT2lsMR8wHQYJKoZI
+hvcNAQkBFhBkdW1teUB0ZXN0LmxvY2FsggkAs+uxyi/hv+MwCQYDVR0SBAIwADAZ
+BgNVHREEEjAQgQ5yb290QGxvY2FsaG9zdDANBgkqhkiG9w0BAQUFAAOBgQBXdedG
+XHLPmOVBeKWjTmaekcaQi44snhYqE1uXRoIQXQsyw+Ya5+n/uRxPKZO/C78EESL0
+8rnLTdZXm4GBYyHYmMy0AdWR7y030viOzAkWWRRRbuecsaUzFCI+F9jTV5LHuRzz
+V8fUKwiEE9swzkWgMpfVTPFuPgzxwG9gMbrBfg==
+-----END CERTIFICATE-----
diff --git a/dummyserver/certs/client_bad.pem b/dummyserver/certs/client_bad.pem
new file mode 100644
index 0000000..e9402fb
--- /dev/null
+++ b/dummyserver/certs/client_bad.pem
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICsDCCAhmgAwIBAgIJAL63Nc6KY94BMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMTExMDExMjMxMjAzWhcNMjExMDA4MjMxMjAzWjBF
+MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
+ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+gQC8HGxvblJ4Z0i/lIlG8jrNsFrCqYRAXtj3xdnnjfUpd/kNhU/KahMsG6urAe/4
+Yj+Zqf1sVnt0Cye8FZE3cN9RAcwJrlTCRiicJiXEbA7cPfMphqNGqjVHtmxQ1OsU
+NHK7cxKa9OX3xmg4h55vxSZYgibAEPO2g3ueGk7RWIAQ8wIDAQABo4GnMIGkMB0G
+A1UdDgQWBBSeeo/YRpdn5DK6bUI7ZDJ57pzGdDB1BgNVHSMEbjBsgBSeeo/YRpdn
+5DK6bUI7ZDJ57pzGdKFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUt
+U3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJAL63Nc6K
+Y94BMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAOntoloMGt1325UR0
+GGEKQJbiRhLXY4otdgFjEvCG2RPZVLxWYhLMu0LkB6HBYULEuoy12ushtRWlhS1k
+6PNRkaZ+LQTSREj6Do4c4zzLxCDmxYmejOz63cIWX2x5IY6qEx2BNOfmM4xEdF8W
+LSGGbQfuAghiEh0giAi4AQloDlY=
+-----END CERTIFICATE-----
diff --git a/dummyserver/certs/server.crt b/dummyserver/certs/server.crt
new file mode 100644
index 0000000..29aea38
--- /dev/null
+++ b/dummyserver/certs/server.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqDCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgTELMAkGA1UEBhMCRkkx
+DjAMBgNVBAgTBWR1bW15MQ4wDAYDVQQHEwVkdW1teTEOMAwGA1UEChMFZHVtbXkx
+DjAMBgNVBAsTBWR1bW15MREwDwYDVQQDEwhTbmFrZU9pbDEfMB0GCSqGSIb3DQEJ
+ARYQZHVtbXlAdGVzdC5sb2NhbDAeFw0xMTEyMjIwNzU4NDBaFw0yMTEyMTgwNzU4
+NDBaMGExCzAJBgNVBAYTAkZJMQ4wDAYDVQQIEwVkdW1teTEOMAwGA1UEBxMFZHVt
+bXkxDjAMBgNVBAoTBWR1bW15MQ4wDAYDVQQLEwVkdW1teTESMBAGA1UEAxMJbG9j
+YWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXe3FqmCWvP8XPxqtT
++0bfL1Tvzvebi46k0WIcUV8bP3vyYiSRXG9ALmyzZH4GHY9UVs4OEDkCMDOBSezB
+0y9ai/9doTNcaictdEBu8nfdXKoTtzrn+VX4UPrkH5hm7NQ1fTQuj1MR7yBCmYqN
+3Q2Q+Efuujyx0FwBzAuy1aKYuwIDAQABo4IBTTCCAUkwCQYDVR0TBAIwADARBglg
+hkgBhvhCAQEEBAMCBkAwKwYJYIZIAYb4QgENBB4WHFRpbnlDQSBHZW5lcmF0ZWQg
+Q2VydGlmaWNhdGUwHQYDVR0OBBYEFBvnSuVKLNPEFMAFqHw292vGHGJSMIG2BgNV
+HSMEga4wgauAFBl3fyNiYkJZRft1ncdzcgS7MwotoYGHpIGEMIGBMQswCQYDVQQG
+EwJGSTEOMAwGA1UECBMFZHVtbXkxDjAMBgNVBAcTBWR1bW15MQ4wDAYDVQQKEwVk
+dW1teTEOMAwGA1UECxMFZHVtbXkxETAPBgNVBAMTCFNuYWtlT2lsMR8wHQYJKoZI
+hvcNAQkBFhBkdW1teUB0ZXN0LmxvY2FsggkAs+uxyi/hv+MwCQYDVR0SBAIwADAZ
+BgNVHREEEjAQgQ5yb290QGxvY2FsaG9zdDANBgkqhkiG9w0BAQUFAAOBgQBXdedG
+XHLPmOVBeKWjTmaekcaQi44snhYqE1uXRoIQXQsyw+Ya5+n/uRxPKZO/C78EESL0
+8rnLTdZXm4GBYyHYmMy0AdWR7y030viOzAkWWRRRbuecsaUzFCI+F9jTV5LHuRzz
+V8fUKwiEE9swzkWgMpfVTPFuPgzxwG9gMbrBfg==
+-----END CERTIFICATE-----
diff --git a/dummyserver/certs/server.csr b/dummyserver/certs/server.csr
new file mode 100644
index 0000000..29aea38
--- /dev/null
+++ b/dummyserver/certs/server.csr
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqDCCAxGgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBgTELMAkGA1UEBhMCRkkx
+DjAMBgNVBAgTBWR1bW15MQ4wDAYDVQQHEwVkdW1teTEOMAwGA1UEChMFZHVtbXkx
+DjAMBgNVBAsTBWR1bW15MREwDwYDVQQDEwhTbmFrZU9pbDEfMB0GCSqGSIb3DQEJ
+ARYQZHVtbXlAdGVzdC5sb2NhbDAeFw0xMTEyMjIwNzU4NDBaFw0yMTEyMTgwNzU4
+NDBaMGExCzAJBgNVBAYTAkZJMQ4wDAYDVQQIEwVkdW1teTEOMAwGA1UEBxMFZHVt
+bXkxDjAMBgNVBAoTBWR1bW15MQ4wDAYDVQQLEwVkdW1teTESMBAGA1UEAxMJbG9j
+YWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXe3FqmCWvP8XPxqtT
++0bfL1Tvzvebi46k0WIcUV8bP3vyYiSRXG9ALmyzZH4GHY9UVs4OEDkCMDOBSezB
+0y9ai/9doTNcaictdEBu8nfdXKoTtzrn+VX4UPrkH5hm7NQ1fTQuj1MR7yBCmYqN
+3Q2Q+Efuujyx0FwBzAuy1aKYuwIDAQABo4IBTTCCAUkwCQYDVR0TBAIwADARBglg
+hkgBhvhCAQEEBAMCBkAwKwYJYIZIAYb4QgENBB4WHFRpbnlDQSBHZW5lcmF0ZWQg
+Q2VydGlmaWNhdGUwHQYDVR0OBBYEFBvnSuVKLNPEFMAFqHw292vGHGJSMIG2BgNV
+HSMEga4wgauAFBl3fyNiYkJZRft1ncdzcgS7MwotoYGHpIGEMIGBMQswCQYDVQQG
+EwJGSTEOMAwGA1UECBMFZHVtbXkxDjAMBgNVBAcTBWR1bW15MQ4wDAYDVQQKEwVk
+dW1teTEOMAwGA1UECxMFZHVtbXkxETAPBgNVBAMTCFNuYWtlT2lsMR8wHQYJKoZI
+hvcNAQkBFhBkdW1teUB0ZXN0LmxvY2FsggkAs+uxyi/hv+MwCQYDVR0SBAIwADAZ
+BgNVHREEEjAQgQ5yb290QGxvY2FsaG9zdDANBgkqhkiG9w0BAQUFAAOBgQBXdedG
+XHLPmOVBeKWjTmaekcaQi44snhYqE1uXRoIQXQsyw+Ya5+n/uRxPKZO/C78EESL0
+8rnLTdZXm4GBYyHYmMy0AdWR7y030viOzAkWWRRRbuecsaUzFCI+F9jTV5LHuRzz
+V8fUKwiEE9swzkWgMpfVTPFuPgzxwG9gMbrBfg==
+-----END CERTIFICATE-----
diff --git a/dummyserver/certs/server.key b/dummyserver/certs/server.key
new file mode 100644
index 0000000..89ab057
--- /dev/null
+++ b/dummyserver/certs/server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQDXe3FqmCWvP8XPxqtT+0bfL1Tvzvebi46k0WIcUV8bP3vyYiSR
+XG9ALmyzZH4GHY9UVs4OEDkCMDOBSezB0y9ai/9doTNcaictdEBu8nfdXKoTtzrn
++VX4UPrkH5hm7NQ1fTQuj1MR7yBCmYqN3Q2Q+Efuujyx0FwBzAuy1aKYuwIDAQAB
+AoGBANOGBM6bbhq7ImYU4qf8+RQrdVg2tc9Fzo+yTnn30sF/rx8/AiCDOV4qdGAh
+HKjKKaGj2H/rotqoEFcxBy05LrgJXxydBP72e9PYhNgKOcSmCQu4yALIPEXfKuIM
+zgAErHVJ2l79fif3D4hzNyz+u5E1A9n3FG9cgaJSiYP8IG2RAkEA82GZ8rBkSGQQ
+ZQ3oFuzPAAL21lbj8D0p76fsCpvS7427DtZDOjhOIKZmaeykpv+qSzRraqEqjDRi
+S4kjQvwh6QJBAOKniZ+NDo2lSpbOFk+XlmABK1DormVpj8KebHEZYok1lRI+WiX9
+Nnoe9YLgix7++6H5SBBCcTB4HvM+5A4BuwMCQQChcX/eZbXP81iQwB3Rfzp8xnqY
+icDf7qKvz9Ma4myU7Y5E9EpaB1mD/P14jDpYcMW050vNyqTfpiwB8TFL0NZpAkEA
+02jkFH9UyMgZV6qo4tqI98l/ZrtyF8OrxSNSEPhVkZf6EQc5vN9/lc8Uv1vESEgb
+3AwRrKDcxRH2BHtv6qSwkwJAGjqnkIcEkA75r1e55/EF2chcZW1+tpwKupE8CtAH
+VXGd5DVwt4cYWkLUj2gF2fJbV97uu2MAg5CFDb+vQ6p5eA==
+-----END RSA PRIVATE KEY-----
diff --git a/dummyserver/certs/server.key.org b/dummyserver/certs/server.key.org
new file mode 100644
index 0000000..709082e
--- /dev/null
+++ b/dummyserver/certs/server.key.org
@@ -0,0 +1,12 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,8B3708EAD53963D4
+
+uyLo4sFmSo7+K1uVgSENI+85JsG5o1JmovvxD/ucUl9CDhDj4KgFzs95r7gjjlhS
+kA/hIY8Ec9i6T3zMXpAswWI5Mv2LE+UdYR5h60dYtIinLC7KF0QIztSecNWy20Bi
+/NkobZhN7VZUuCEoSRWj4Ia3EuATF8Y9ZRGFPNsqMbSAhsGZ1P5xbDMEpE+5PbJP
+LvdF9yWDT77rHeI4CKV4aP/yxtm1heEhKw5o6hdpPBQajPpjSQbh7/V6Qd0QsKcV
+n27kPnSabsTbbc2IR40il4mZfHvXAlp4KoHL3RUgaons7q0hAUpUi+vJXbEukGGt
+3dlyWwKwEFS7xBQ1pQvzcePI4/fRQxhZNxeFZW6n12Y3X61vg1IsG7usPhRe3iDP
+3g1MXQMAhxaECnDN9b006IeoYdaktd4wrs/fn8x6Yz4=
+-----END RSA PRIVATE KEY-----
diff --git a/dummyserver/certs/server.no_san.crt b/dummyserver/certs/server.no_san.crt
new file mode 100644
index 0000000..cb89a14
--- /dev/null
+++ b/dummyserver/certs/server.no_san.crt
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE-----
+MIIChzCCAfACCQCmk6is+6REjDANBgkqhkiG9w0BAQUFADCBhzELMAkGA1UEBhMC
+Q0ExEDAOBgNVBAgMB09udGFyaW8xEDAOBgNVBAcMB09udGFyaW8xHzAdBgNVBAoM
+FlNoYXpvdydzIFVzZWQgQ2FycyBJbmMxEjAQBgNVBAMMCWxvY2FsaG9zdDEfMB0G
+CSqGSIb3DQEJARYQc2hhem93QGdtYWlsLmNvbTAeFw0xNDEyMDMyMjE3MjVaFw00
+NDEyMDIyMjE3MjVaMIGHMQswCQYDVQQGEwJDQTEQMA4GA1UECAwHT250YXJpbzEQ
+MA4GA1UEBwwHT250YXJpbzEfMB0GA1UECgwWU2hhem93J3MgVXNlZCBDYXJzIElu
+YzESMBAGA1UEAwwJbG9jYWxob3N0MR8wHQYJKoZIhvcNAQkBFhBzaGF6b3dAZ21h
+aWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDXe3FqmCWvP8XPxqtT
++0bfL1Tvzvebi46k0WIcUV8bP3vyYiSRXG9ALmyzZH4GHY9UVs4OEDkCMDOBSezB
+0y9ai/9doTNcaictdEBu8nfdXKoTtzrn+VX4UPrkH5hm7NQ1fTQuj1MR7yBCmYqN
+3Q2Q+Efuujyx0FwBzAuy1aKYuwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAHI/m9/O
+bVR3zBOJZUKlHzTRvfYbYhhfrrcQlbwhjKqNyZcQTL/bJdtQSL19g3ftC5wZPI+y
+66R24MqGmRcv5kT32HcuIK1Xhx4nDqTqnTNvGkaIh5CqS4DEP+iqtwDoEbQt8DwL
+ejKtvZlyQRKFPTMtmv4VsTIHeVOAj+pXn595
+-----END CERTIFICATE-----
diff --git a/dummyserver/certs/server.no_san.csr b/dummyserver/certs/server.no_san.csr
new file mode 100644
index 0000000..d4bb7c3
--- /dev/null
+++ b/dummyserver/certs/server.no_san.csr
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIByDCCATECAQAwgYcxCzAJBgNVBAYTAkNBMRAwDgYDVQQIDAdPbnRhcmlvMRAw
+DgYDVQQHDAdPbnRhcmlvMR8wHQYDVQQKDBZTaGF6b3cncyBVc2VkIENhcnMgSW5j
+MRIwEAYDVQQDDAlsb2NhbGhvc3QxHzAdBgkqhkiG9w0BCQEWEHNoYXpvd0BnbWFp
+bC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANd7cWqYJa8/xc/Gq1P7
+Rt8vVO/O95uLjqTRYhxRXxs/e/JiJJFcb0AubLNkfgYdj1RWzg4QOQIwM4FJ7MHT
+L1qL/12hM1xqJy10QG7yd91cqhO3Ouf5VfhQ+uQfmGbs1DV9NC6PUxHvIEKZio3d
+DZD4R+66PLHQXAHMC7LVopi7AgMBAAGgADANBgkqhkiG9w0BAQUFAAOBgQDGWkxr
+mCa2h+/HnptucimU+T4QESBNc3fHhnnWaj4RXJaS0xwUDaG81INnxj6KNVgOtemK
+VlwG7Ziqj1i+gZ1UpbmMp1YkSD/0+N8vb2BStuXlc5rP0+cG1DlzV1Dc+FaDHHsy
+7MfyeHTa5FYdSeKsiAFHlQ84g08Pd7hW0c+SxA==
+-----END CERTIFICATE REQUEST-----
diff --git a/dummyserver/handlers.py b/dummyserver/handlers.py
new file mode 100644
index 0000000..53fbe4a
--- /dev/null
+++ b/dummyserver/handlers.py
@@ -0,0 +1,281 @@
+from __future__ import print_function
+
+import collections
+import gzip
+import json
+import logging
+import sys
+import time
+import zlib
+
+from io import BytesIO
+from tornado.web import RequestHandler
+
+try:
+    from urllib.parse import urlsplit
+except ImportError:
+    from urlparse import urlsplit
+
+log = logging.getLogger(__name__)
+
+
+class Response(object):
+    def __init__(self, body='', status='200 OK', headers=None):
+        self.body = body
+        self.status = status
+        self.headers = headers or [("Content-type", "text/plain")]
+
+    def __call__(self, request_handler):
+        status, reason = self.status.split(' ', 1)
+        request_handler.set_status(int(status), reason)
+        for header,value in self.headers:
+            request_handler.add_header(header,value)
+
+        # chunked
+        if isinstance(self.body, list):
+            for item in self.body:
+                if not isinstance(item, bytes):
+                    item = item.encode('utf8')
+                request_handler.write(item)
+                request_handler.flush()
+        else:
+            body = self.body
+            if not isinstance(body, bytes):
+                body = body.encode('utf8')
+
+            request_handler.write(body)
+
+
+RETRY_TEST_NAMES = collections.defaultdict(int)
+
+class TestingApp(RequestHandler):
+    """
+    Simple app that performs various operations, useful for testing an HTTP
+    library.
+
+    Given any path, it will attempt to load a corresponding local method if
+    it exists. Status code 200 indicates success, 400 indicates failure. Each
+    method has its own conditions for success/failure.
+    """
+    def get(self):
+        """ Handle GET requests """
+        self._call_method()
+
+    def post(self):
+        """ Handle POST requests """
+        self._call_method()
+
+    def put(self):
+        """ Handle PUT requests """
+        self._call_method()
+
+    def options(self):
+        """ Handle OPTIONS requests """
+        self._call_method()
+
+    def _call_method(self):
+        """ Call the correct method in this class based on the incoming URI """
+        req = self.request
+        req.params = {}
+        for k, v in req.arguments.items():
+            req.params[k] = next(iter(v))
+
+        path = req.path[:]
+        if not path.startswith('/'):
+            path = urlsplit(path).path
+
+        target = path[1:].replace('/', '_')
+        method = getattr(self, target, self.index)
+
+        resp = method(req)
+
+        if dict(resp.headers).get('Connection') == 'close':
+            # FIXME: Can we kill the connection somehow?
+            pass
+
+        resp(self)
+
+    def index(self, _request):
+        "Render simple message"
+        return Response("Dummy server!")
+
+    def source_address(self, request):
+        """Return the requester's IP address."""
+        return Response(request.remote_ip)
+
+    def set_up(self, request):
+        test_type = request.params.get('test_type')
+        test_id = request.params.get('test_id')
+        if test_id:
+            print('\nNew test %s: %s' % (test_type, test_id))
+        else:
+            print('\nNew test %s' % test_type)
+        return Response("Dummy server is ready!")
+
+    def specific_method(self, request):
+        "Confirm that the request matches the desired method type"
+        method = request.params.get('method')
+        if method and not isinstance(method, str):
+            method = method.decode('utf8')
+
+        if request.method != method:
+            return Response("Wrong method: %s != %s" %
+                            (method, request.method), status='400 Bad Request')
+        return Response()
+
+    def upload(self, request):
+        "Confirm that the uploaded file conforms to specification"
+        # FIXME: This is a huge broken mess
+        param = request.params.get('upload_param', 'myfile').decode('ascii')
+        filename = request.params.get('upload_filename', '').decode('utf-8')
+        size = int(request.params.get('upload_size', '0'))
+        files_ = request.files.get(param)
+
+        if len(files_) != 1:
+            return Response("Expected 1 file for '%s', not %d" %(param, len(files_)),
+                                                    status='400 Bad Request')
+        file_ = files_[0]
+
+        data = file_['body']
+        if int(size) != len(data):
+            return Response("Wrong size: %d != %d" %
+                            (size, len(data)), status='400 Bad Request')
+
+        if filename != file_['filename']:
+            return Response("Wrong filename: %s != %s" %
+                            (filename, file_.filename),
+                            status='400 Bad Request')
+
+        return Response()
+
+    def redirect(self, request):
+        "Perform a redirect to ``target``"
+        target = request.params.get('target', '/')
+        headers = [('Location', target)]
+        return Response(status='303 See Other', headers=headers)
+
+    def keepalive(self, request):
+        if request.params.get('close', b'0') == b'1':
+            headers = [('Connection', 'close')]
+            return Response('Closing', headers=headers)
+
+        headers = [('Connection', 'keep-alive')]
+        return Response('Keeping alive', headers=headers)
+
+    def sleep(self, request):
+        "Sleep for a specified amount of ``seconds``"
+        seconds = float(request.params.get('seconds', '1'))
+        time.sleep(seconds)
+        return Response()
+
+    def echo(self, request):
+        "Echo back the params"
+        if request.method == 'GET':
+            return Response(request.query)
+
+        return Response(request.body)
+
+    def encodingrequest(self, request):
+        "Check for UA accepting gzip/deflate encoding"
+        data = b"hello, world!"
+        encoding = request.headers.get('Accept-Encoding', '')
+        headers = None
+        if encoding == 'gzip':
+            headers = [('Content-Encoding', 'gzip')]
+            file_ = BytesIO()
+            zipfile = gzip.GzipFile('', mode='w', fileobj=file_)
+            zipfile.write(data)
+            zipfile.close()
+            data = file_.getvalue()
+        elif encoding == 'deflate':
+            headers = [('Content-Encoding', 'deflate')]
+            data = zlib.compress(data)
+        elif encoding == 'garbage-gzip':
+            headers = [('Content-Encoding', 'gzip')]
+            data = 'garbage'
+        elif encoding == 'garbage-deflate':
+            headers = [('Content-Encoding', 'deflate')]
+            data = 'garbage'
+        return Response(data, headers=headers)
+
+    def headers(self, request):
+        return Response(json.dumps(request.headers))
+
+    def successful_retry(self, request):
+        """ Handler which will return an error and then success
+
+        It's not currently very flexible as the number of retries is hard-coded.
+        """
+        test_name = request.headers.get('test-name', None)
+        if not test_name:
+            return Response("test-name header not set",
+                            status="400 Bad Request")
+
+        RETRY_TEST_NAMES[test_name] += 1
+
+        if RETRY_TEST_NAMES[test_name] >= 2:
+            return Response("Retry successful!")
+        else:
+            return Response("need to keep retrying!", status="418 I'm A Teapot")
+
+    def chunked(self, request):
+        return Response(['123'] * 4)
+
+    def chunked_gzip(self, request):
+        chunks = []
+        compressor = zlib.compressobj(6, zlib.DEFLATED, 16 + zlib.MAX_WBITS)
+
+        for uncompressed in [b'123'] * 4:
+            chunks.append(compressor.compress(uncompressed))
+
+        chunks.append(compressor.flush())
+
+        return Response(chunks, headers=[('Content-Encoding', 'gzip')])
+
+    def shutdown(self, request):
+        sys.exit()
+
+
+# RFC2231-aware replacement of internal tornado function
+def _parse_header(line):
+    r"""Parse a Content-type like header.
+
+    Return the main content-type and a dictionary of options.
+
+    >>> d = _parse_header("CD: fd; foo=\"bar\"; file*=utf-8''T%C3%A4st")[1]
+    >>> d['file'] == 'T\u00e4st'
+    True
+    >>> d['foo']
+    'bar'
+    """
+    import tornado.httputil
+    import email.utils
+    from urllib3.packages import six
+    if not six.PY3:
+        line = line.encode('utf-8')
+    parts = tornado.httputil._parseparam(';' + line)
+    key = next(parts)
+    # decode_params treats first argument special, but we already stripped key
+    params = [('Dummy', 'value')]
+    for p in parts:
+        i = p.find('=')
+        if i >= 0:
+            name = p[:i].strip().lower()
+            value = p[i + 1:].strip()
+            params.append((name, value))
+    params = email.utils.decode_params(params)
+    params.pop(0) # get rid of the dummy again
+    pdict = {}
+    for name, value in params:
+        value = email.utils.collapse_rfc2231_value(value)
+        if len(value) >= 2 and value[0] == '"' and value[-1] == '"':
+            value = value[1:-1]
+        pdict[name] = value
+    return key, pdict
+
+# TODO: make the following conditional as soon as we know a version
+#       which does not require this fix.
+#       See https://github.com/facebook/tornado/issues/868
+if True:
+    import tornado.httputil
+    tornado.httputil._parse_header = _parse_header
diff --git a/dummyserver/proxy.py b/dummyserver/proxy.py
new file mode 100755
index 0000000..aca92a7
--- /dev/null
+++ b/dummyserver/proxy.py
@@ -0,0 +1,137 @@
+#!/usr/bin/env python
+#
+# Simple asynchronous HTTP proxy with tunnelling (CONNECT).
+#
+# GET/POST proxying based on
+# http://groups.google.com/group/python-tornado/msg/7bea08e7a049cf26
+#
+# Copyright (C) 2012 Senko Rasic <senko.rasic@dobarkod.hr>
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+import sys
+import socket
+
+import tornado.httpserver
+import tornado.ioloop
+import tornado.iostream
+import tornado.web
+import tornado.httpclient
+
+__all__ = ['ProxyHandler', 'run_proxy']
+
+
+class ProxyHandler(tornado.web.RequestHandler):
+    SUPPORTED_METHODS = ['GET', 'POST', 'CONNECT']
+
+    @tornado.web.asynchronous
+    def get(self):
+
+        def handle_response(response):
+            if response.error and not isinstance(response.error,
+                    tornado.httpclient.HTTPError):
+                self.set_status(500)
+                self.write('Internal server error:\n' + str(response.error))
+                self.finish()
+            else:
+                self.set_status(response.code)
+                for header in ('Date', 'Cache-Control', 'Server',
+                        'Content-Type', 'Location'):
+                    v = response.headers.get(header)
+                    if v:
+                        self.set_header(header, v)
+                if response.body:
+                    self.write(response.body)
+                self.finish()
+
+        req = tornado.httpclient.HTTPRequest(url=self.request.uri,
+            method=self.request.method, body=self.request.body,
+            headers=self.request.headers, follow_redirects=False,
+            allow_nonstandard_methods=True)
+
+        client = tornado.httpclient.AsyncHTTPClient()
+        try:
+            client.fetch(req, handle_response)
+        except tornado.httpclient.HTTPError as e:
+            if hasattr(e, 'response') and e.response:
+                self.handle_response(e.response)
+            else:
+                self.set_status(500)
+                self.write('Internal server error:\n' + str(e))
+                self.finish()
+
+    @tornado.web.asynchronous
+    def post(self):
+        return self.get()
+
+    @tornado.web.asynchronous
+    def connect(self):
+        host, port = self.request.uri.split(':')
+        client = self.request.connection.stream
+
+        def read_from_client(data):
+            upstream.write(data)
+
+        def read_from_upstream(data):
+            client.write(data)
+
+        def client_close(data=None):
+            if upstream.closed():
+                return
+            if data:
+                upstream.write(data)
+            upstream.close()
+
+        def upstream_close(data=None):
+            if client.closed():
+                return
+            if data:
+                client.write(data)
+            client.close()
+
+        def start_tunnel():
+            client.read_until_close(client_close, read_from_client)
+            upstream.read_until_close(upstream_close, read_from_upstream)
+            client.write(b'HTTP/1.0 200 Connection established\r\n\r\n')
+
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
+        upstream = tornado.iostream.IOStream(s)
+        upstream.connect((host, int(port)), start_tunnel)
+
+
+def run_proxy(port, start_ioloop=True):
+    """
+    Run proxy on the specified port. If start_ioloop is True (default),
+    the tornado IOLoop will be started immediately.
+    """
+    app = tornado.web.Application([
+        (r'.*', ProxyHandler),
+    ])
+    app.listen(port)
+    ioloop = tornado.ioloop.IOLoop.instance()
+    if start_ioloop:
+        ioloop.start()
+
+if __name__ == '__main__':
+    port = 8888
+    if len(sys.argv) > 1:
+        port = int(sys.argv[1])
+
+    print ("Starting HTTP proxy on port %d" % port)
+    run_proxy(port)
diff --git a/dummyserver/server.py b/dummyserver/server.py
new file mode 100755
index 0000000..63124d3
--- /dev/null
+++ b/dummyserver/server.py
@@ -0,0 +1,213 @@
+#!/usr/bin/env python
+
+"""
+Dummy server used for unit testing.
+"""
+from __future__ import print_function
+
+import errno
+import logging
+import os
+import random
+import string
+import sys
+import threading
+import socket
+import warnings
+
+from urllib3.exceptions import HTTPWarning
+
+from tornado.platform.auto import set_close_exec
+import tornado.httpserver
+import tornado.ioloop
+import tornado.web
+
+
+log = logging.getLogger(__name__)
+
+CERTS_PATH = os.path.join(os.path.dirname(__file__), 'certs')
+DEFAULT_CERTS = {
+    'certfile': os.path.join(CERTS_PATH, 'server.crt'),
+    'keyfile': os.path.join(CERTS_PATH, 'server.key'),
+}
+NO_SAN_CERTS = {
+    'certfile': os.path.join(CERTS_PATH, 'server.no_san.crt'),
+    'keyfile': DEFAULT_CERTS['keyfile']
+}
+DEFAULT_CA = os.path.join(CERTS_PATH, 'cacert.pem')
+DEFAULT_CA_BAD = os.path.join(CERTS_PATH, 'client_bad.pem')
+NO_SAN_CA = os.path.join(CERTS_PATH, 'cacert.no_san.pem')
+
+
+# Different types of servers we have:
+
+
+class NoIPv6Warning(HTTPWarning):
+    "IPv6 is not available"
+    pass
+
+
+class SocketServerThread(threading.Thread):
+    """
+    :param socket_handler: Callable which receives a socket argument for one
+        request.
+    :param ready_event: Event which gets set when the socket handler is
+        ready to receive requests.
+    """
+    def __init__(self, socket_handler, host='localhost', port=8081,
+                 ready_event=None):
+        threading.Thread.__init__(self)
+        self.daemon = True
+
+        self.socket_handler = socket_handler
+        self.host = host
+        self.ready_event = ready_event
+
+    def _start_server(self):
+        if socket.has_ipv6:
+            sock = socket.socket(socket.AF_INET6)
+        else:
+            warnings.warn("No IPv6 support. Falling back to IPv4.",
+                          NoIPv6Warning)
+            sock = socket.socket(socket.AF_INET)
+        if sys.platform != 'win32':
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        sock.bind((self.host, 0))
+        self.port = sock.getsockname()[1]
+
+        # Once listen() returns, the server socket is ready
+        sock.listen(0)
+
+        if self.ready_event:
+            self.ready_event.set()
+
+        self.socket_handler(sock)
+        sock.close()
+
+    def run(self):
+        self.server = self._start_server()
+
+
+# FIXME: there is a pull request patching bind_sockets in Tornado directly.
+# If it gets merged and released we can drop this and use
+# `tornado.netutil.bind_sockets` again.
+# https://github.com/facebook/tornado/pull/977
+
+def bind_sockets(port, address=None, family=socket.AF_UNSPEC, backlog=128,
+                 flags=None):
+    """Creates listening sockets bound to the given port and address.
+
+    Returns a list of socket objects (multiple sockets are returned if
+    the given address maps to multiple IP addresses, which is most common
+    for mixed IPv4 and IPv6 use).
+
+    Address may be either an IP address or hostname.  If it's a hostname,
+    the server will listen on all IP addresses associated with the
+    name.  Address may be an empty string or None to listen on all
+    available interfaces.  Family may be set to either `socket.AF_INET`
+    or `socket.AF_INET6` to restrict to IPv4 or IPv6 addresses, otherwise
+    both will be used if available.
+
+    The ``backlog`` argument has the same meaning as for
+    `socket.listen() <socket.socket.listen>`.
+
+    ``flags`` is a bitmask of AI_* flags to `~socket.getaddrinfo`, like
+    ``socket.AI_PASSIVE | socket.AI_NUMERICHOST``.
+    """
+    sockets = []
+    if address == "":
+        address = None
+    if not socket.has_ipv6 and family == socket.AF_UNSPEC:
+        # Python can be compiled with --disable-ipv6, which causes
+        # operations on AF_INET6 sockets to fail, but does not
+        # automatically exclude those results from getaddrinfo
+        # results.
+        # http://bugs.python.org/issue16208
+        family = socket.AF_INET
+    if flags is None:
+        flags = socket.AI_PASSIVE
+    binded_port = None
+    for res in set(socket.getaddrinfo(address, port, family,
+                                      socket.SOCK_STREAM, 0, flags)):
+        af, socktype, proto, canonname, sockaddr = res
+        try:
+            sock = socket.socket(af, socktype, proto)
+        except socket.error as e:
+            if e.args[0] == errno.EAFNOSUPPORT:
+                continue
+            raise
+        set_close_exec(sock.fileno())
+        if os.name != 'nt':
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        if af == socket.AF_INET6:
+            # On linux, ipv6 sockets accept ipv4 too by default,
+            # but this makes it impossible to bind to both
+            # 0.0.0.0 in ipv4 and :: in ipv6.  On other systems,
+            # separate sockets *must* be used to listen for both ipv4
+            # and ipv6.  For consistency, always disable ipv4 on our
+            # ipv6 sockets and use a separate ipv4 socket when needed.
+            #
+            # Python 2.x on windows doesn't have IPPROTO_IPV6.
+            if hasattr(socket, "IPPROTO_IPV6"):
+                sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+
+        # automatic port allocation with port=None
+        # should bind on the same port on IPv4 and IPv6
+        host, requested_port = sockaddr[:2]
+        if requested_port == 0 and binded_port is not None:
+            sockaddr = tuple([host, binded_port] + list(sockaddr[2:]))
+
+        sock.setblocking(0)
+        sock.bind(sockaddr)
+        binded_port = sock.getsockname()[1]
+        sock.listen(backlog)
+        sockets.append(sock)
+    return sockets
+
+
+def run_tornado_app(app, io_loop, certs, scheme, host):
+    if scheme == 'https':
+        http_server = tornado.httpserver.HTTPServer(app, ssl_options=certs,
+                                                    io_loop=io_loop)
+    else:
+        http_server = tornado.httpserver.HTTPServer(app, io_loop=io_loop)
+
+    sockets = bind_sockets(None, address=host)
+    port = sockets[0].getsockname()[1]
+    http_server.add_sockets(sockets)
+    return http_server, port
+
+
+def run_loop_in_thread(io_loop):
+    t = threading.Thread(target=io_loop.start)
+    t.start()
+    return t
+
+
+def get_unreachable_address():
+    while True:
+        host = ''.join(random.choice(string.ascii_lowercase)
+                       for _ in range(60))
+        sockaddr = (host, 54321)
+
+        # check if we are really "lucky" and hit an actual server
+        try:
+            s = socket.create_connection(sockaddr)
+        except socket.error:
+            return sockaddr
+        else:
+            s.close()
+
+
+if __name__ == '__main__':
+    # For debugging dummyserver itself - python -m dummyserver.server
+    from .testcase import TestingApp
+    host = '127.0.0.1'
+
+    io_loop = tornado.ioloop.IOLoop()
+    app = tornado.web.Application([(r".*", TestingApp)])
+    server, port = run_tornado_app(app, io_loop, None,
+                                   'http', host)
+    server_thread = run_loop_in_thread(io_loop)
+
+    print("Listening on http://{host}:{port}".format(host=host, port=port))
diff --git a/dummyserver/testcase.py b/dummyserver/testcase.py
new file mode 100644
index 0000000..67e62cf
--- /dev/null
+++ b/dummyserver/testcase.py
@@ -0,0 +1,133 @@
+import unittest
+import socket
+import threading
+from nose.plugins.skip import SkipTest
+from tornado import ioloop, web
+
+from dummyserver.server import (
+    SocketServerThread,
+    run_tornado_app,
+    run_loop_in_thread,
+    DEFAULT_CERTS,
+)
+from dummyserver.handlers import TestingApp
+from dummyserver.proxy import ProxyHandler
+
+
+
+class SocketDummyServerTestCase(unittest.TestCase):
+    """
+    A simple socket-based server is created for this class that is good for
+    exactly one request.
+    """
+    scheme = 'http'
+    host = 'localhost'
+
+    @classmethod
+    def _start_server(cls, socket_handler):
+        ready_event = threading.Event()
+        cls.server_thread = SocketServerThread(socket_handler=socket_handler,
+                                               ready_event=ready_event,
+                                               host=cls.host)
+        cls.server_thread.start()
+        ready_event.wait(5)
+        if not ready_event.is_set():
+            raise Exception("most likely failed to start server")
+        cls.port = cls.server_thread.port
+
+    @classmethod
+    def tearDownClass(cls):
+        if hasattr(cls, 'server_thread'):
+            cls.server_thread.join(0.1)
+
+
+class HTTPDummyServerTestCase(unittest.TestCase):
+    """ A simple HTTP server that runs when your test class runs
+
+    Have your unittest class inherit from this one, and then a simple server
+    will start when your tests run, and automatically shut down when they
+    complete. For examples of what test requests you can send to the server,
+    see the TestingApp in dummyserver/handlers.py.
+    """
+    scheme = 'http'
+    host = 'localhost'
+    host_alt = '127.0.0.1'  # Some tests need two hosts
+    certs = DEFAULT_CERTS
+
+    @classmethod
+    def _start_server(cls):
+        cls.io_loop = ioloop.IOLoop()
+        app = web.Application([(r".*", TestingApp)])
+        cls.server, cls.port = run_tornado_app(app, cls.io_loop, cls.certs,
+                                               cls.scheme, cls.host)
+        cls.server_thread = run_loop_in_thread(cls.io_loop)
+
+    @classmethod
+    def _stop_server(cls):
+        cls.io_loop.add_callback(cls.server.stop)
+        cls.io_loop.add_callback(cls.io_loop.stop)
+        cls.server_thread.join()
+
+    @classmethod
+    def setUpClass(cls):
+        cls._start_server()
+
+    @classmethod
+    def tearDownClass(cls):
+        cls._stop_server()
+
+
+class HTTPSDummyServerTestCase(HTTPDummyServerTestCase):
+    scheme = 'https'
+    host = 'localhost'
+    certs = DEFAULT_CERTS
+
+
+class HTTPDummyProxyTestCase(unittest.TestCase):
+
+    http_host = 'localhost'
+    http_host_alt = '127.0.0.1'
+
+    https_host = 'localhost'
+    https_host_alt = '127.0.0.1'
+    https_certs = DEFAULT_CERTS
+
+    proxy_host = 'localhost'
+    proxy_host_alt = '127.0.0.1'
+
+    @classmethod
+    def setUpClass(cls):
+        cls.io_loop = ioloop.IOLoop()
+
+        app = web.Application([(r'.*', TestingApp)])
+        cls.http_server, cls.http_port = run_tornado_app(
+            app, cls.io_loop, None, 'http', cls.http_host)
+
+        app = web.Application([(r'.*', TestingApp)])
+        cls.https_server, cls.https_port = run_tornado_app(
+            app, cls.io_loop, cls.https_certs, 'https', cls.http_host)
+
+        app = web.Application([(r'.*', ProxyHandler)])
+        cls.proxy_server, cls.proxy_port = run_tornado_app(
+            app, cls.io_loop, None, 'http', cls.proxy_host)
+
+        cls.server_thread = run_loop_in_thread(cls.io_loop)
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.io_loop.add_callback(cls.http_server.stop)
+        cls.io_loop.add_callback(cls.https_server.stop)
+        cls.io_loop.add_callback(cls.proxy_server.stop)
+        cls.io_loop.add_callback(cls.io_loop.stop)
+        cls.server_thread.join()
+
+
+class IPv6HTTPDummyServerTestCase(HTTPDummyServerTestCase):
+    host = '::1'
+
+    @classmethod
+    def setUpClass(cls):
+        if not socket.has_ipv6:
+            raise SkipTest('IPv6 not available')
+        else:
+            super(IPv6HTTPDummyServerTestCase, cls).setUpClass()