diff -ur pan-0.11.2/config.h.in pan-ssl/config.h.in
--- pan-0.11.2/config.h.in	Thu Feb  7 22:05:07 2002
+++ pan-ssl/config.h.in	Tue Mar 26 20:02:16 2002
@@ -230,3 +230,5 @@
 
 /* Define to `unsigned' if <sys/types.h> does not define. */
 #undef size_t
+
+#undef USE_SSL
diff -ur pan-0.11.2/configure.in pan-ssl/configure.in
--- pan-0.11.2/configure.in	Thu Feb  7 21:32:30 2002
+++ pan-ssl/configure.in	Tue Mar 26 20:02:28 2002
@@ -178,6 +178,27 @@
 AC_SUBST(GNOME_XML_CFLAGS)
 AC_SUBST(GNOME_XML_LIBS)
 
+dnl Check for OpenSSL
+AC_ARG_ENABLE(ssl,
+	[  --enable-ssl            Enable SSL with OpenSSL [default=no]],
+	[ac_cv_enable_ssl=$enableval], [ac_cv_enable_ssl=no])
+AC_MSG_CHECKING([whether to use OpenSSL])
+if test $ac_cv_enable_ssl = yes; then
+	AC_MSG_RESULT(yes)
+	AC_MSG_CHECKING([if openssl is available])
+	LIBS="$LIBS -lssl -lcrypto"
+	AC_TRY_LINK([
+#include <openssl/opensslv.h>
+],	[ return OPENSSL_VERSION_NUMBER; ],
+	[ AC_MSG_RESULT(yes)
+	  AC_DEFINE(USE_SSL) ],
+	[ AC_MSG_RESULT(no)
+	  LIBS="$ac_save_LIBS"
+	  ac_cv_enable_ssl=no ])
+else
+	AC_MSG_RESULT(no)
+fi
+
 
 dnl ******************************
 dnl Makefiles
diff -ur pan-0.11.2/pan/base/server.c pan-ssl/pan/base/server.c
--- pan-0.11.2/pan/base/server.c	Wed Feb  6 07:24:08 2002
+++ pan-ssl/pan/base/server.c	Tue Mar 26 12:42:49 2002
@@ -63,6 +63,10 @@
 	debug1 (DEBUG_PAN_OBJECT, "server_constructor: %p", server);
 	server->posting = FALSE;
 	server->gen_msgid = FALSE;
+#ifdef USE_SSL	
+	server->use_ssl = FALSE;
+	server->ssl_port = 563;
+#endif USE_SSL	
 	server->need_auth = FALSE;
 	server->online = FALSE;
 	server->online_prompted = FALSE;
diff -ur pan-0.11.2/pan/base/server.h pan-ssl/pan/base/server.h
--- pan-0.11.2/pan/base/server.h	Wed Feb  6 07:24:08 2002
+++ pan-ssl/pan/base/server.h	Tue Mar 26 12:42:49 2002
@@ -51,6 +51,9 @@
 	/*Fields*/
 	guint posting              : 1;  /* is posting allowed? */
 	guint gen_msgid            : 1;
+#ifdef USE_SSL	
+	guint use_ssl		   : 1;  /* connect via ssl? */
+#endif	
 	guint need_auth            : 1;  /* need authorization ? */
 	guint online               : 1;  /* is this server online? */
 	guint online_prompted      : 1;  /* true if user's been asked to go online for some tasks. */
@@ -58,6 +61,9 @@
 	gint8 max_connections;           /* max connections to server */
         gint16 idle_secs_before_timeout;
 	gint port;	                 /* port number.  This is usually 119 for NNTP. */
+#ifdef USE_SSL
+	gint ssl_port;			 /* ssl port. Usually 563 */
+#endif	
 	time_t last_newgroup_list_time;
 	gchar * address;                 /* server net address */
 	gchar * name;	                 /* pretty name, i.e. Erols */
diff -ur pan-0.11.2/pan/base/serverlist.c pan-ssl/pan/base/serverlist.c
--- pan-0.11.2/pan/base/serverlist.c	Tue Feb  5 14:04:13 2002
+++ pan-ssl/pan/base/serverlist.c	Tue Mar 26 12:42:49 2002
@@ -145,6 +145,12 @@
 				g_strdup(name);
 			server->gen_msgid =
 				pan_config_get_int ("Generate_Msgid=0");
+#ifdef USE_SSL
+			server->use_ssl =
+				pan_config_get_int ("Use_SSL=0");
+			server->ssl_port =
+				pan_config_get_int ("SSL_Port=563");
+#endif				
 			server->need_auth =
 				pan_config_get_int ("Auth_Required=0");
 			server->username =
@@ -411,7 +417,13 @@
 
 		g_snprintf (buf, sizeof(buf), "/Pan/%s/Generate_Msgid", s->name);
 		pan_config_set_int (buf, s->gen_msgid);
-
+#ifdef USE_SSL		
+		g_snprintf (buf, sizeof(buf), "/Pan/%s/Use_SSL", s->name);
+		pan_config_set_int (buf, s->use_ssl);
+		
+		g_snprintf (buf, sizeof(buf), "/Pan/%s/SSL_Port", s->name);
+		pan_config_set_int (buf, s->ssl_port);
+#endif
 		g_snprintf (buf, sizeof(buf), "/Pan/%s/Username", s->name);
 		pan_config_set_string (buf, s->username);
 
diff -ur pan-0.11.2/pan/prefs.c pan-ssl/pan/prefs.c
--- pan-0.11.2/pan/prefs.c	Sun Feb  3 17:18:37 2002
+++ pan-ssl/pan/prefs.c	Tue Mar 26 12:42:49 2002
@@ -76,6 +76,10 @@
 	GtkWidget * server_password_label;
 	GtkWidget * server_password;
 	GtkWidget * msgid_cbutton;
+#ifdef USE_SSL	
+	GtkWidget * use_ssl_cbutton;
+	GtkWidget * server_ssl_port;
+#endif
 	GtkWidget * idle_secs_before_timeout;
 	Server * server;
 }
@@ -906,6 +910,10 @@
 				old->max_connections = new->max_connections;
 				old->idle_secs_before_timeout = new->idle_secs_before_timeout;
 				old->gen_msgid = new->gen_msgid;
+#ifdef USE_SSL				
+				old->use_ssl = new->use_ssl;
+				old->ssl_port = new -> ssl_port;
+#endif
 			}
 			else
 			{
@@ -1222,6 +1230,10 @@
 		server->port = atoi((gtk_entry_get_text (GTK_ENTRY(sprof->server_port))));
 		server->need_auth = (!GTK_TOGGLE_BUTTON (sprof->auth_cbutton)->active) ? 0 : 1;
 		server->gen_msgid = (!GTK_TOGGLE_BUTTON (sprof->msgid_cbutton)->active) ? 0 : 1;
+#ifdef USE_SSL
+		server->use_ssl = (!GTK_TOGGLE_BUTTON (sprof->use_ssl_cbutton)->active) ? 0 : 1;
+		server->ssl_port = atoi((gtk_entry_get_text (GTK_ENTRY(sprof->server_ssl_port))));
+#endif
 		server->username = gtk_editable_get_chars (GTK_EDITABLE (sprof->server_username), 0, -1);
 		server->password = gtk_editable_get_chars (GTK_EDITABLE (sprof->server_password), 0, -1);
 		server->idle_secs_before_timeout = gtk_spin_button_get_value_as_int (GTK_SPIN_BUTTON (sprof->idle_secs_before_timeout));
@@ -1481,6 +1493,33 @@
 	connect_signal_to_profile_changed (w, "toggled", dialog);
         gtk_box_pack_start (GTK_BOX(vbox), w, FALSE, FALSE, 0);
         sprof->msgid_cbutton = w;
+
+#ifdef USE_SSL
+	hbox = gtk_hbox_new (FALSE, GNOME_PAD_SMALL);
+	
+	/* TOGGLE: Use SSL */ 
+        w = gtk_check_button_new_with_label (_("Use SSL on port: "));
+	gtk_toggle_button_set_active (GTK_TOGGLE_BUTTON(w), server && server->use_ssl);
+	connect_signal_to_prefs_changed (w, "toggled");
+	connect_signal_to_profile_changed (w, "toggled", dialog);
+        gtk_box_pack_start (GTK_BOX(hbox), w, FALSE, FALSE, 0);
+        sprof->use_ssl_cbutton = w;
+
+	/* server ssl port */
+	w = gtk_entry_new ();
+	if (1) {
+		int num = server && server->ssl_port ? server->ssl_port : 563;
+		char buf[32];
+		g_snprintf (buf, sizeof(buf), "%d", num);
+		gtk_entry_set_text (GTK_ENTRY(w), buf);
+	}
+	connect_signal_to_prefs_changed (w, "changed");
+	connect_signal_to_profile_changed (w, "changed", dialog);
+	gtk_box_pack_start (GTK_BOX (hbox), w, FALSE, FALSE, 0);
+	sprof->server_ssl_port = w;
+	gtk_box_pack_start (GTK_BOX (vbox), hbox, FALSE, FALSE, 0);
+	
+#endif
 
         gtk_table_attach (GTK_TABLE(table), frame,
                           0, 2, 7, 9,
diff -ur pan-0.11.2/pan/queue.c pan-ssl/pan/queue.c
--- pan-0.11.2/pan/queue.c	Tue Jan 22 23:53:17 2002
+++ pan-ssl/pan/queue.c	Tue Mar 26 13:13:50 2002
@@ -835,7 +835,14 @@
 			debug1 (DEBUG_QUEUE, "making a new socket to %s", server->address);
 
 			gui_set_connecting_flag (TRUE);
+#ifndef USE_SSL			
 			sock = pan_socket_new (server->address, server->port);
+#else
+			if (server->use_ssl)
+				sock = pan_socket_new_ssl (server->address, server->ssl_port);
+			else
+				sock = pan_socket_new (server->address, server->port);
+#endif
 			pan_socket_set_nntp_auth (sock, server->need_auth, server->username, server->password); 
 
 			debug1 (DEBUG_QUEUE, "new socket %p", sock);
diff -ur pan-0.11.2/pan/sockets.c pan-ssl/pan/sockets.c
--- pan-0.11.2/pan/sockets.c	Sat Jan 19 22:40:32 2002
+++ pan-ssl/pan/sockets.c	Tue Mar 26 13:16:19 2002
@@ -45,6 +45,15 @@
 
 #include <pan/sockets.h>
 
+#ifdef USE_SSL
+#  include <openssl/crypto.h>
+#  include <openssl/x509.h>
+#  include <openssl/pem.h>
+#  include <openssl/ssl.h>
+#  include <openssl/err.h>
+#endif
+
+
 /*********************
 **********************  Defines / Enumerated types
 *********************/
@@ -55,6 +64,11 @@
 **********************  Variables
 *********************/
 
+#ifdef USE_SSL
+static SSL_CTX *ssl_ctx_SSLv23;
+static SSL_CTX *ssl_ctx_TLSv1;
+#endif
+
 static gulong total_bytes = 0;
 
 /*********************
@@ -78,6 +92,29 @@
 	return sock;
 }
 
+#ifdef USE_SSL
+PanSocket*
+pan_socket_new_ssl (const gchar    * address,
+                    gint             port)
+{
+	PanSocket * sock;
+
+	if(ssl_ctx_SSLv23 == NULL)
+		ssl_init();
+	
+	/* sanity clause */
+	g_return_val_if_fail (is_nonempty_string (address), NULL);
+	g_return_val_if_fail (port>=0, NULL);
+
+	/* create the socket */
+	sock = g_new0 (PanSocket, 1);	
+	debug1 (DEBUG_PAN_OBJECT, "pan_socket_new_ssl: %p", sock);
+	pan_socket_constructor (sock, pan_socket_destructor, address, port);
+	if(!ssl_init_socket(sock))
+		fprintf(stderr,"ssl_init_socket failed\n");
+	return sock;
+}
+#endif
 void
 pan_socket_constructor (PanSocket             * sock,
 			PanObjectDestructor     destructor,
@@ -124,7 +161,9 @@
 	sock->nntp_group_name = NULL;
 	sock->nntp_username = NULL;
 	sock->nntp_password = NULL;
-
+#ifdef USE_SSL
+	sock->ssl = NULL;
+#endif
 	/* set up the serv_addr struct */
 	memset ( &serv_addr, 0, sizeof(serv_addr) );
 	serv_addr.sin_family = AF_INET;
@@ -237,28 +281,42 @@
 	FD_SET (ps->sockfd, &read_fds);
 
 	/* wait 60 seconds for an OK to read */
-	errno = 0;
-	tv.tv_sec = 60;
-	tv.tv_usec = 0;
-	retval = select (ps->sockfd+1, &read_fds, NULL, NULL, &tv);
-	my_errno = errno;
+	/* [Colin] I don't know why this doesn't work over ssl :-/ */
+#ifdef USE_SSL
+	if(!ps->ssl) {
+#endif
+		errno = 0;
+		tv.tv_sec = 60;
+		tv.tv_usec = 0;
+		retval = select (ps->sockfd+1, &read_fds, NULL, NULL, &tv);
+		my_errno = errno;
 
-	/* did select fail? */
-	if (!FD_ISSET(ps->sockfd, &read_fds))
-	{
-		GString * str = g_string_new (NULL);
-		g_string_sprintf (str, _("Timed out waiting to read from the server."));
-		if (my_errno != 0)
-			g_string_sprintfa (str, " %s", g_strerror(my_errno));
-		log_add (LOG_ERROR, str->str);
-		ps->error = TRUE;
-		g_string_free (str, TRUE);
-		return -1;
+		/* did select fail? */
+		if (!FD_ISSET(ps->sockfd, &read_fds))
+		{
+			GString * str = g_string_new (NULL);
+			g_string_sprintf (str, _("Timed out waiting to read from the server."));
+			if (my_errno != 0)
+				g_string_sprintfa (str, " %s", g_strerror(my_errno));
+			log_add (LOG_ERROR, str->str);
+			ps->error = TRUE;
+			g_string_free (str, TRUE);
+			return -1;
+		}
+#ifdef USE_SSL		
 	}
+#endif
 
 	/* try to read from the server... */
 	errno = 0;
+#ifdef USE_SSL
+	if(ps->ssl)
+		read_count = ssl_read (ps->ssl, ps->inbuf, BUFSIZE);
+	else
+		read_count = read (ps->sockfd, ps->inbuf, BUFSIZE);
+#else		
 	read_count = read (ps->sockfd, ps->inbuf, BUFSIZE);
+#endif
 	my_errno = errno;
 	ps->endbuf = ps->inbuf + read_count;
 	ps->inptr = ps->inbuf;
@@ -397,7 +455,14 @@
 		}
 
 		/* try to write to the server... */
+#ifdef USE_SSL
+		if(sock->ssl)
+			nwritten = ssl_write (sock->ssl, pch, nleft);
+		else 
+			nwritten = write (sock->sockfd, pch, nleft);		
+#else	
 		nwritten = write (sock->sockfd, pch, nleft);
+#endif	
 		sock->bytes_written += nwritten;
 		if (nwritten == -1) {
 			log_add (LOG_ERROR, _("An error occurred writing to the server."));
@@ -477,3 +542,155 @@
 {
 	return total_bytes / (gulong)1024;
 }
+
+#ifdef USE_SSL
+/* the following SSL code adapted from Sylpheed-claws 
+   http://sylpheed-claws.sourceforge.net/ */
+   
+void ssl_init(void)
+{
+	SSL_library_init();
+	SSL_load_error_strings();
+
+	ssl_ctx_SSLv23 = SSL_CTX_new(SSLv23_client_method());
+	if (ssl_ctx_SSLv23 == NULL) {
+		fprintf(stderr,"SSLv23 not available\n");
+	} else {
+		fprintf(stderr,"SSLv23 available\n");
+	}
+
+	ssl_ctx_TLSv1 = SSL_CTX_new(TLSv1_client_method());
+	if (ssl_ctx_TLSv1 == NULL) {
+		fprintf(stderr,"TLSv1 not available\n");
+	} else {
+		fprintf(stderr,"TLSv1 available\n");
+	}
+}
+
+void ssl_done(void)
+{
+	if (ssl_ctx_SSLv23) {
+		SSL_CTX_free(ssl_ctx_SSLv23);
+	}
+
+	if (ssl_ctx_TLSv1) {
+		SSL_CTX_free(ssl_ctx_TLSv1);
+	}
+}
+
+gboolean ssl_init_socket(PanSocket *sockinfo)
+{
+	return ssl_init_socket_with_method(sockinfo, SSL_METHOD_SSLv23);
+}
+
+gboolean ssl_init_socket_with_method(PanSocket *sockinfo, SSLMethod method)
+{
+	X509 *server_cert;
+	gint ret;
+
+	switch (method) {
+	case SSL_METHOD_SSLv23:
+		if (!ssl_ctx_SSLv23) {
+			fprintf(stderr,"SSL method not available\n");
+			return FALSE;
+		}
+		sockinfo->ssl = SSL_new(ssl_ctx_SSLv23);
+		break;
+	case SSL_METHOD_TLSv1:
+		if (!ssl_ctx_TLSv1) {
+			fprintf(stderr,"SSL method not available\n");
+			return FALSE;
+		}
+		sockinfo->ssl = SSL_new(ssl_ctx_TLSv1);
+		break;
+	default:
+		fprintf(stderr,"Unknown SSL method *PROGRAM BUG*\n");
+		return FALSE;
+		break;
+	}
+
+	if (sockinfo->ssl == NULL) {
+		fprintf(stderr,"Error creating ssl context\n");
+		return FALSE;
+	}
+
+	SSL_set_fd(sockinfo->ssl, sockinfo->sockfd);
+	if ((ret = SSL_connect(sockinfo->ssl)) == -1) {
+		fprintf(stderr,"SSL connect failed (%s)\n",
+			    ERR_error_string(ERR_get_error(), NULL));
+		return FALSE;
+	}
+
+	/* Get the cipher */
+
+	fprintf(stderr,"SSL connection using %s\n", SSL_get_cipher(sockinfo->ssl));
+
+	/* Get server's certificate (note: beware of dynamic allocation) */
+
+	if ((server_cert = SSL_get_peer_certificate(sockinfo->ssl)) != NULL) {
+		gchar *str;
+
+		fprintf(stderr,"Server certificate:\n");
+
+		if ((str = X509_NAME_oneline(X509_get_subject_name(server_cert), 0, 0)) != NULL) {
+			fprintf(stderr,"  Subject: %s\n", str);
+			free(str);
+		}
+
+		if ((str = X509_NAME_oneline(X509_get_issuer_name(server_cert), 0, 0)) != NULL) {
+			fprintf(stderr,"  Issuer: %s\n", str);
+			free(str);
+		}
+
+		X509_free(server_cert);
+	}
+
+	return TRUE;
+}
+
+void ssl_done_socket(PanSocket *sockinfo)
+{
+	if (sockinfo->ssl) {
+		SSL_free(sockinfo->ssl);
+	}
+}
+
+gint ssl_read(SSL *ssl, gchar *buf, gint len)
+{
+	gchar *newline, *bp = buf;
+	gint n;
+
+	if (--len < 1)
+		return -1;
+	do {
+		if ((n = SSL_peek(ssl, bp, len)) <= 0)
+			return -1;
+		if ((newline = memchr(bp, '\n', n)) != NULL)
+			n = newline - bp + 1;
+		if ((n = SSL_read(ssl, bp, n)) < 0)
+			return -1;
+		bp += n;
+		len -= n;
+	} while (!newline && len);
+
+	*bp = '\0';
+	return bp - buf;
+}
+
+gint ssl_write(SSL *ssl, const gchar *buf, gint len)
+{
+	gint n, wrlen = 0;
+
+	while (len) {
+		n = SSL_write(ssl, buf, len);
+		if (n <= 0)
+			return -1;
+		len -= n;
+		wrlen += n;
+		buf += n;
+	}
+
+	return wrlen;
+}
+
+#endif /* USE_SSL */
diff -ur pan-0.11.2/pan/sockets.h pan-ssl/pan/sockets.h
--- pan-0.11.2/pan/sockets.h	Tue Aug 28 00:02:50 2001
+++ pan-ssl/pan/sockets.h	Tue Mar 26 13:14:26 2002
@@ -27,6 +27,14 @@
 
 #define PAN_SOCKET(a) ((PanSocket *)a)
 
+#ifdef USE_SSL
+#  include <openssl/crypto.h>
+#  include <openssl/x509.h>
+#  include <openssl/pem.h>
+#  include <openssl/ssl.h>
+#  include <openssl/err.h>
+#endif
+
 typedef struct _PanSocket           PanSocket;
 
 struct _PanSocket
@@ -50,7 +58,9 @@
 	gchar * nntp_username;
 	gchar * nntp_password;
 	GArray * line_buffer;
-
+#ifdef USE_SSL
+	SSL *ssl;
+#endif
 	/* statistics */
 	gchar * host;
 	unsigned int bytes_read;
@@ -76,6 +86,11 @@
 PanSocket*   pan_socket_new                  (const gchar          * address,
                                               int                    port);
 
+#ifdef USE_SSL
+PanSocket*   pan_socket_new_ssl		     (const gchar	   * address,
+					      int		     port);
+#endif					      
+
 void         pan_socket_set_nntp_auth        (PanSocket            * socket,
                                               gboolean               need_auth,
                                               const gchar          * username,
@@ -111,6 +126,23 @@
 void         pan_socket_reset_statistics    (PanSocket            * sock);
 
 gulong       pan_socket_get_total_xfer_K    (void);
+
+#ifdef USE_SSL
+typedef enum {
+	SSL_METHOD_SSLv23,
+	SSL_METHOD_TLSv1
+} SSLMethod;
+
+void ssl_init				(void);
+void ssl_done				(void);
+gboolean ssl_init_socket		(PanSocket	*sockinfo);
+gboolean ssl_init_socket_with_method	(PanSocket	*sockinfo,
+					 SSLMethod	 method);
+void ssl_done_socket			(PanSocket	*sockinfo);
+gint ssl_read 				(SSL *ssl, gchar *buf, gint len);
+gint ssl_write 				(SSL *ssl, const gchar *buf, gint len);
+
+#endif /* USE_SSL */
 
 
 #endif /* __PAN_SOCKET_H__ */
