int ssl_check_srvr_ecc_cert_and_alg(X509 *x, SSL_CIPHER *cs)
	{
	unsigned long alg = cs->algorithms;
	EVP_PKEY *pkey = NULL;
	int keysize = 0;
	int signature_nid = 0;

	if (SSL_C_IS_EXPORT(cs))
		{
		/* ECDH key length in export ciphers must be <= 163 bits */
		pkey = X509_get_pubkey(x);
		if (pkey == NULL) return 0;
		keysize = EVP_PKEY_bits(pkey);
		EVP_PKEY_free(pkey);
		if (keysize > 163) return 0;
		}

	/* This call populates the ex_flags field correctly */
	X509_check_purpose(x, -1, 0);
	if ((x->sig_alg) && (x->sig_alg->algorithm))
		signature_nid = OBJ_obj2nid(x->sig_alg->algorithm);
	if (alg & SSL_kECDHe || alg & SSL_kECDHr) 
		{
		/* key usage, if present, must allow key agreement */
		if (ku_reject(x, X509v3_KU_KEY_AGREEMENT))
			{
			SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT);
			return 0;
			}
		if (alg & SSL_kECDHe)
			{
			/* signature alg must be ECDSA */
			if (signature_nid != NID_ecdsa_with_SHA1)
				{
				SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE);
				return 0;
				}
			}
		if (alg & SSL_kECDHr)
			{
			/* signature alg must be RSA */

			const char *sig = OBJ_nid2ln(signature_nid);
			if (sig == NULL)
				{
				ERR_clear_error();
				sig = "unknown";
				}
			if (strstr(sig, "WithRSA") == NULL)
				{
				SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE);
				return 0;
				}
			}
		} 
	if (alg & SSL_aECDSA)
		{
		/* key usage, if present, must allow signing */
		if (ku_reject(x, X509v3_KU_DIGITAL_SIGNATURE))
			{
			SSLerr(SSL_F_SSL_CHECK_SRVR_ECC_CERT_AND_ALG, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
			return 0;
			}
		}

	return 1;  /* all checks are ok */
	}