int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
	{
	int ret=0;
	int nostrict = 1;
	unsigned long alg_k, alg_a = 0;

	/* If we have custom certificate types set, use them */
	if (s->cert->ctypes)
		{
		memcpy(p, s->cert->ctypes, s->cert->ctype_num);
		return (int)s->cert->ctype_num;
		}
	/* Get mask of algorithms disabled by signature list */
	ssl_set_sig_mask(&alg_a, s, SSL_SECOP_SIGALG_MASK);
	if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT)
		nostrict = 0;

	alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

#ifndef OPENSSL_NO_GOST
	if (s->version >= TLS1_VERSION)
		{
		if (alg_k & SSL_kGOST)
			{
			p[ret++]=TLS_CT_GOST94_SIGN;
			p[ret++]=TLS_CT_GOST01_SIGN;
			return(ret);
			}
		}
#endif

#ifndef OPENSSL_NO_DH
	if (alg_k & (SSL_kDHr|SSL_kDHE))
		{
#  ifndef OPENSSL_NO_RSA
		/* Since this refers to a certificate signed with an RSA
		 * algorithm, only check for rsa signing in strict mode.
		 */
		if (nostrict || !(alg_a & SSL_aRSA))
			p[ret++]=SSL3_CT_RSA_FIXED_DH;
#  endif
#  ifndef OPENSSL_NO_DSA
		if (nostrict || !(alg_a & SSL_aDSS))
			p[ret++]=SSL3_CT_DSS_FIXED_DH;
#  endif
		}
	if ((s->version == SSL3_VERSION) &&
		(alg_k & (SSL_kDHE|SSL_kDHd|SSL_kDHr)))
		{
#  ifndef OPENSSL_NO_RSA
		p[ret++]=SSL3_CT_RSA_EPHEMERAL_DH;
#  endif
#  ifndef OPENSSL_NO_DSA
		p[ret++]=SSL3_CT_DSS_EPHEMERAL_DH;
#  endif
		}
#endif /* !OPENSSL_NO_DH */
#ifndef OPENSSL_NO_RSA
	if (!(alg_a & SSL_aRSA))
		p[ret++]=SSL3_CT_RSA_SIGN;
#endif
#ifndef OPENSSL_NO_DSA
	if (!(alg_a & SSL_aDSS))
		p[ret++]=SSL3_CT_DSS_SIGN;
#endif
#ifndef OPENSSL_NO_ECDH
	if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->version >= TLS1_VERSION))
		{
		if (nostrict || !(alg_a & SSL_aRSA))
			p[ret++]=TLS_CT_RSA_FIXED_ECDH;
		if (nostrict || !(alg_a & SSL_aECDSA))
			p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
		}
#endif

#ifndef OPENSSL_NO_ECDSA
	/* ECDSA certs can be used with RSA cipher suites as well 
	 * so we don't need to check for SSL_kECDH or SSL_kECDHE
	 */
	if (s->version >= TLS1_VERSION)
		{
		if (!(alg_a & SSL_aECDSA))
			p[ret++]=TLS_CT_ECDSA_SIGN;
		}
#endif	
	return(ret);
	}