-spec abbreviated(gen_statem:event_type(),
            #finished{verify_data :: term()} |
            #next_protocol{selected_protocol :: term()} |
            term(),
            #state{static_env ::
                       #static_env{role :: client | server,
                                   transport_cb :: atom(),
                                   protocol_cb :: tls_gen_connection | dtls_gen_connection,
                                   data_tag :: atom(),
                                   close_tag :: atom(),
                                   error_tag :: atom(),
                                   passive_tag :: atom(),
                                   host :: string() | inet:ip_address(),
                                   port :: integer(),
                                   socket :: port() | tuple(),
                                   cert_db :: reference() | undefined,
                                   session_cache :: db_handle(),
                                   session_cache_cb :: atom(),
                                   crl_db :: term(),
                                   file_ref_db :: db_handle(),
                                   cert_db_ref :: certdb_ref() | undefined,
                                   trackers :: [{atom(), pid()}] | undefined},
                   connection_env ::
                       #connection_env{user_application :: {Monitor :: reference(), User :: pid()},
                                       downgrade ::
                                           {NewController :: pid(), From :: gen_statem:from()} |
                                           undefined,
                                       socket_terminated :: boolean(),
                                       socket_tls_closed :: boolean(),
                                       negotiated_version :: ssl_record:ssl_version() | undefined,
                                       erl_dist_handle :: erlang:dist_handle() | undefined,
                                       cert_key_alts ::
                                           #{eddsa => list(),
                                             ecdsa => list(),
                                             rsa_pss_pss => list(),
                                             rsa => list(),
                                             dsa => list()} |
                                           secret_printout() |
                                           undefined} |
                       secret_printout(),
                   ssl_options :: ssl_options(),
                   socket_options ::
                       #socket_options{mode :: term(),
                                       packet :: term(),
                                       packet_size :: term(),
                                       header :: term(),
                                       active :: term()},
                   handshake_env ::
                       #handshake_env{client_hello_version :: ssl_record:ssl_version() | undefined,
                                      unprocessed_handshake_events :: integer(),
                                      tls_handshake_history ::
                                          ssl_handshake:ssl_handshake_history() |
                                          secret_printout() |
                                          undefined,
                                      expecting_finished :: boolean(),
                                      renegotiation ::
                                          undefined |
                                          {boolean(), From :: term() | internal | peer},
                                      resumption :: boolean(),
                                      change_cipher_spec_sent :: boolean(),
                                      sni_guided_cert_selection :: boolean(),
                                      early_data_accepted :: boolean(),
                                      allow_renegotiate :: boolean(),
                                      continue_status :: term(),
                                      sni_hostname :: term(),
                                      max_frag_enum :: undefined | {max_frag_enum, integer()},
                                      expecting_next_protocol_negotiation :: boolean(),
                                      next_protocol :: undefined | binary(),
                                      alpn :: term(),
                                      negotiated_protocol :: term(),
                                      hashsign_algorithm :: term(),
                                      cert_hashsign_algorithm :: term(),
                                      kex_algorithm :: ssl:kex_algo(),
                                      kex_keys ::
                                          {PublicKey :: binary(), PrivateKey :: binary()} |
                                          #'ECPrivateKey'{version :: term(),
                                                          privateKey :: term(),
                                                          parameters :: term(),
                                                          publicKey :: term(),
                                                          attributes :: term()} |
                                          undefined |
                                          secret_printout(),
                                      diffie_hellman_params ::
                                          #'DHParameter'{prime :: term(),
                                                         base :: term(),
                                                         privateValueLength :: term()} |
                                          undefined |
                                          secret_printout(),
                                      srp_params ::
                                          #srp_user{generator :: binary(),
                                                    prime :: binary(),
                                                    salt :: binary(),
                                                    verifier :: binary()} |
                                          secret_printout() |
                                          undefined,
                                      public_key_info ::
                                          ssl_handshake:public_key_info() | undefined,
                                      premaster_secret :: binary() | secret_printout() | undefined,
                                      server_psk_identity :: binary() | undefined,
                                      cookie_iv_shard :: {binary(), binary()} | undefined,
                                      stapling_state :: term()} |
                       secret_printout(),
                   flight_buffer :: list() | map(),
                   client_certificate_status ::
                       not_requested | requested | empty | needs_verifying | verified,
                   protocol_specific :: map(),
                   session ::
                       #session{session_id :: term(),
                                internal_id :: term(),
                                peer_certificate :: term(),
                                own_certificates :: term(),
                                private_key :: term(),
                                cipher_suite :: term(),
                                master_secret :: term(),
                                srp_username :: term(),
                                is_resumable :: term(),
                                time_stamp :: term(),
                                ecc :: term(),
                                sign_alg :: term(),
                                dh_public_value :: term()} |
                       secret_printout(),
                   key_share :: term(),
                   connection_states :: ssl_record:connection_states() | secret_printout(),
                   protocol_buffers :: term() | secret_printout(),
                   user_data_buffer ::
                       undefined | {[binary()], non_neg_integer(), [binary()]} | secret_printout(),
                   bytes_to_read :: undefined | integer(),
                   start_or_recv_from :: term(),
                   log_level :: term()}) ->
               gen_statem:state_function_result().

-spec certify(gen_statem:event_type(),
        #hello_request{} |
        #certificate{asn1_certificates :: term()} |
        #server_key_exchange{exchange_keys :: term()} |
        #certificate_request{certificate_types :: term(),
                             hashsign_algorithms :: term(),
                             certificate_authorities :: term()} |
        #server_hello_done{} |
        #client_key_exchange{exchange_keys :: term()} |
        term(),
        #state{static_env ::
                   #static_env{role :: client | server,
                               transport_cb :: atom(),
                               protocol_cb :: tls_gen_connection | dtls_gen_connection,
                               data_tag :: atom(),
                               close_tag :: atom(),
                               error_tag :: atom(),
                               passive_tag :: atom(),
                               host :: string() | inet:ip_address(),
                               port :: integer(),
                               socket :: port() | tuple(),
                               cert_db :: reference() | undefined,
                               session_cache :: db_handle(),
                               session_cache_cb :: atom(),
                               crl_db :: term(),
                               file_ref_db :: db_handle(),
                               cert_db_ref :: certdb_ref() | undefined,
                               trackers :: [{atom(), pid()}] | undefined},
               connection_env ::
                   #connection_env{user_application :: {Monitor :: reference(), User :: pid()},
                                   downgrade ::
                                       {NewController :: pid(), From :: gen_statem:from()} |
                                       undefined,
                                   socket_terminated :: boolean(),
                                   socket_tls_closed :: boolean(),
                                   negotiated_version :: ssl_record:ssl_version() | undefined,
                                   erl_dist_handle :: erlang:dist_handle() | undefined,
                                   cert_key_alts ::
                                       #{eddsa => list(),
                                         ecdsa => list(),
                                         rsa_pss_pss => list(),
                                         rsa => list(),
                                         dsa => list()} |
                                       secret_printout() |
                                       undefined} |
                   secret_printout(),
               ssl_options :: ssl_options(),
               socket_options ::
                   #socket_options{mode :: term(),
                                   packet :: term(),
                                   packet_size :: term(),
                                   header :: term(),
                                   active :: term()},
               handshake_env ::
                   #handshake_env{client_hello_version :: ssl_record:ssl_version() | undefined,
                                  unprocessed_handshake_events :: integer(),
                                  tls_handshake_history ::
                                      ssl_handshake:ssl_handshake_history() |
                                      secret_printout() |
                                      undefined,
                                  expecting_finished :: boolean(),
                                  renegotiation ::
                                      undefined | {boolean(), From :: term() | internal | peer},
                                  resumption :: boolean(),
                                  change_cipher_spec_sent :: boolean(),
                                  sni_guided_cert_selection :: boolean(),
                                  early_data_accepted :: boolean(),
                                  allow_renegotiate :: boolean(),
                                  continue_status :: term(),
                                  sni_hostname :: term(),
                                  max_frag_enum :: undefined | {max_frag_enum, integer()},
                                  expecting_next_protocol_negotiation :: boolean(),
                                  next_protocol :: undefined | binary(),
                                  alpn :: term(),
                                  negotiated_protocol :: term(),
                                  hashsign_algorithm :: term(),
                                  cert_hashsign_algorithm :: term(),
                                  kex_algorithm :: ssl:kex_algo(),
                                  kex_keys ::
                                      {PublicKey :: binary(), PrivateKey :: binary()} |
                                      #'ECPrivateKey'{version :: term(),
                                                      privateKey :: term(),
                                                      parameters :: term(),
                                                      publicKey :: term(),
                                                      attributes :: term()} |
                                      undefined |
                                      secret_printout(),
                                  diffie_hellman_params ::
                                      #'DHParameter'{prime :: term(),
                                                     base :: term(),
                                                     privateValueLength :: term()} |
                                      undefined |
                                      secret_printout(),
                                  srp_params ::
                                      #srp_user{generator :: binary(),
                                                prime :: binary(),
                                                salt :: binary(),
                                                verifier :: binary()} |
                                      secret_printout() |
                                      undefined,
                                  public_key_info :: ssl_handshake:public_key_info() | undefined,
                                  premaster_secret :: binary() | secret_printout() | undefined,
                                  server_psk_identity :: binary() | undefined,
                                  cookie_iv_shard :: {binary(), binary()} | undefined,
                                  stapling_state :: term()} |
                   secret_printout(),
               flight_buffer :: list() | map(),
               client_certificate_status ::
                   not_requested | requested | empty | needs_verifying | verified,
               protocol_specific :: map(),
               session ::
                   #session{session_id :: term(),
                            internal_id :: term(),
                            peer_certificate :: term(),
                            own_certificates :: term(),
                            private_key :: term(),
                            cipher_suite :: term(),
                            master_secret :: term(),
                            srp_username :: term(),
                            is_resumable :: term(),
                            time_stamp :: term(),
                            ecc :: term(),
                            sign_alg :: term(),
                            dh_public_value :: term()} |
                   secret_printout(),
               key_share :: term(),
               connection_states :: ssl_record:connection_states() | secret_printout(),
               protocol_buffers :: term() | secret_printout(),
               user_data_buffer ::
                   undefined | {[binary()], non_neg_integer(), [binary()]} | secret_printout(),
               bytes_to_read :: undefined | integer(),
               start_or_recv_from :: term(),
               log_level :: term()}) ->
           gen_statem:state_function_result().

-spec cipher(gen_statem:event_type(),
       #hello_request{} | #finished{verify_data :: term()} | term(),
       #state{static_env ::
                  #static_env{role :: client | server,
                              transport_cb :: atom(),
                              protocol_cb :: tls_gen_connection | dtls_gen_connection,
                              data_tag :: atom(),
                              close_tag :: atom(),
                              error_tag :: atom(),
                              passive_tag :: atom(),
                              host :: string() | inet:ip_address(),
                              port :: integer(),
                              socket :: port() | tuple(),
                              cert_db :: reference() | undefined,
                              session_cache :: db_handle(),
                              session_cache_cb :: atom(),
                              crl_db :: term(),
                              file_ref_db :: db_handle(),
                              cert_db_ref :: certdb_ref() | undefined,
                              trackers :: [{atom(), pid()}] | undefined},
              connection_env ::
                  #connection_env{user_application :: {Monitor :: reference(), User :: pid()},
                                  downgrade ::
                                      {NewController :: pid(), From :: gen_statem:from()} |
                                      undefined,
                                  socket_terminated :: boolean(),
                                  socket_tls_closed :: boolean(),
                                  negotiated_version :: ssl_record:ssl_version() | undefined,
                                  erl_dist_handle :: erlang:dist_handle() | undefined,
                                  cert_key_alts ::
                                      #{eddsa => list(),
                                        ecdsa => list(),
                                        rsa_pss_pss => list(),
                                        rsa => list(),
                                        dsa => list()} |
                                      secret_printout() |
                                      undefined} |
                  secret_printout(),
              ssl_options :: ssl_options(),
              socket_options ::
                  #socket_options{mode :: term(),
                                  packet :: term(),
                                  packet_size :: term(),
                                  header :: term(),
                                  active :: term()},
              handshake_env ::
                  #handshake_env{client_hello_version :: ssl_record:ssl_version() | undefined,
                                 unprocessed_handshake_events :: integer(),
                                 tls_handshake_history ::
                                     ssl_handshake:ssl_handshake_history() |
                                     secret_printout() |
                                     undefined,
                                 expecting_finished :: boolean(),
                                 renegotiation ::
                                     undefined | {boolean(), From :: term() | internal | peer},
                                 resumption :: boolean(),
                                 change_cipher_spec_sent :: boolean(),
                                 sni_guided_cert_selection :: boolean(),
                                 early_data_accepted :: boolean(),
                                 allow_renegotiate :: boolean(),
                                 continue_status :: term(),
                                 sni_hostname :: term(),
                                 max_frag_enum :: undefined | {max_frag_enum, integer()},
                                 expecting_next_protocol_negotiation :: boolean(),
                                 next_protocol :: undefined | binary(),
                                 alpn :: term(),
                                 negotiated_protocol :: term(),
                                 hashsign_algorithm :: term(),
                                 cert_hashsign_algorithm :: term(),
                                 kex_algorithm :: ssl:kex_algo(),
                                 kex_keys ::
                                     {PublicKey :: binary(), PrivateKey :: binary()} |
                                     #'ECPrivateKey'{version :: term(),
                                                     privateKey :: term(),
                                                     parameters :: term(),
                                                     publicKey :: term(),
                                                     attributes :: term()} |
                                     undefined |
                                     secret_printout(),
                                 diffie_hellman_params ::
                                     #'DHParameter'{prime :: term(),
                                                    base :: term(),
                                                    privateValueLength :: term()} |
                                     undefined |
                                     secret_printout(),
                                 srp_params ::
                                     #srp_user{generator :: binary(),
                                               prime :: binary(),
                                               salt :: binary(),
                                               verifier :: binary()} |
                                     secret_printout() |
                                     undefined,
                                 public_key_info :: ssl_handshake:public_key_info() | undefined,
                                 premaster_secret :: binary() | secret_printout() | undefined,
                                 server_psk_identity :: binary() | undefined,
                                 cookie_iv_shard :: {binary(), binary()} | undefined,
                                 stapling_state :: term()} |
                  secret_printout(),
              flight_buffer :: list() | map(),
              client_certificate_status ::
                  not_requested | requested | empty | needs_verifying | verified,
              protocol_specific :: map(),
              session ::
                  #session{session_id :: term(),
                           internal_id :: term(),
                           peer_certificate :: term(),
                           own_certificates :: term(),
                           private_key :: term(),
                           cipher_suite :: term(),
                           master_secret :: term(),
                           srp_username :: term(),
                           is_resumable :: term(),
                           time_stamp :: term(),
                           ecc :: term(),
                           sign_alg :: term(),
                           dh_public_value :: term()} |
                  secret_printout(),
              key_share :: term(),
              connection_states :: ssl_record:connection_states() | secret_printout(),
              protocol_buffers :: term() | secret_printout(),
              user_data_buffer ::
                  undefined | {[binary()], non_neg_integer(), [binary()]} | secret_printout(),
              bytes_to_read :: undefined | integer(),
              start_or_recv_from :: term(),
              log_level :: term()}) ->
          gen_statem:state_function_result().

-spec connection(gen_statem:event_type(),
           term(),
           #state{static_env ::
                      #static_env{role :: client | server,
                                  transport_cb :: atom(),
                                  protocol_cb :: tls_gen_connection | dtls_gen_connection,
                                  data_tag :: atom(),
                                  close_tag :: atom(),
                                  error_tag :: atom(),
                                  passive_tag :: atom(),
                                  host :: string() | inet:ip_address(),
                                  port :: integer(),
                                  socket :: port() | tuple(),
                                  cert_db :: reference() | undefined,
                                  session_cache :: db_handle(),
                                  session_cache_cb :: atom(),
                                  crl_db :: term(),
                                  file_ref_db :: db_handle(),
                                  cert_db_ref :: certdb_ref() | undefined,
                                  trackers :: [{atom(), pid()}] | undefined},
                  connection_env ::
                      #connection_env{user_application :: {Monitor :: reference(), User :: pid()},
                                      downgrade ::
                                          {NewController :: pid(), From :: gen_statem:from()} |
                                          undefined,
                                      socket_terminated :: boolean(),
                                      socket_tls_closed :: boolean(),
                                      negotiated_version :: ssl_record:ssl_version() | undefined,
                                      erl_dist_handle :: erlang:dist_handle() | undefined,
                                      cert_key_alts ::
                                          #{eddsa => list(),
                                            ecdsa => list(),
                                            rsa_pss_pss => list(),
                                            rsa => list(),
                                            dsa => list()} |
                                          secret_printout() |
                                          undefined} |
                      secret_printout(),
                  ssl_options :: ssl_options(),
                  socket_options ::
                      #socket_options{mode :: term(),
                                      packet :: term(),
                                      packet_size :: term(),
                                      header :: term(),
                                      active :: term()},
                  handshake_env ::
                      #handshake_env{client_hello_version :: ssl_record:ssl_version() | undefined,
                                     unprocessed_handshake_events :: integer(),
                                     tls_handshake_history ::
                                         ssl_handshake:ssl_handshake_history() |
                                         secret_printout() |
                                         undefined,
                                     expecting_finished :: boolean(),
                                     renegotiation ::
                                         undefined | {boolean(), From :: term() | internal | peer},
                                     resumption :: boolean(),
                                     change_cipher_spec_sent :: boolean(),
                                     sni_guided_cert_selection :: boolean(),
                                     early_data_accepted :: boolean(),
                                     allow_renegotiate :: boolean(),
                                     continue_status :: term(),
                                     sni_hostname :: term(),
                                     max_frag_enum :: undefined | {max_frag_enum, integer()},
                                     expecting_next_protocol_negotiation :: boolean(),
                                     next_protocol :: undefined | binary(),
                                     alpn :: term(),
                                     negotiated_protocol :: term(),
                                     hashsign_algorithm :: term(),
                                     cert_hashsign_algorithm :: term(),
                                     kex_algorithm :: ssl:kex_algo(),
                                     kex_keys ::
                                         {PublicKey :: binary(), PrivateKey :: binary()} |
                                         #'ECPrivateKey'{version :: term(),
                                                         privateKey :: term(),
                                                         parameters :: term(),
                                                         publicKey :: term(),
                                                         attributes :: term()} |
                                         undefined |
                                         secret_printout(),
                                     diffie_hellman_params ::
                                         #'DHParameter'{prime :: term(),
                                                        base :: term(),
                                                        privateValueLength :: term()} |
                                         undefined |
                                         secret_printout(),
                                     srp_params ::
                                         #srp_user{generator :: binary(),
                                                   prime :: binary(),
                                                   salt :: binary(),
                                                   verifier :: binary()} |
                                         secret_printout() |
                                         undefined,
                                     public_key_info ::
                                         ssl_handshake:public_key_info() | undefined,
                                     premaster_secret :: binary() | secret_printout() | undefined,
                                     server_psk_identity :: binary() | undefined,
                                     cookie_iv_shard :: {binary(), binary()} | undefined,
                                     stapling_state :: term()} |
                      secret_printout(),
                  flight_buffer :: list() | map(),
                  client_certificate_status ::
                      not_requested | requested | empty | needs_verifying | verified,
                  protocol_specific :: map(),
                  session ::
                      #session{session_id :: term(),
                               internal_id :: term(),
                               peer_certificate :: term(),
                               own_certificates :: term(),
                               private_key :: term(),
                               cipher_suite :: term(),
                               master_secret :: term(),
                               srp_username :: term(),
                               is_resumable :: term(),
                               time_stamp :: term(),
                               ecc :: term(),
                               sign_alg :: term(),
                               dh_public_value :: term()} |
                      secret_printout(),
                  key_share :: term(),
                  connection_states :: ssl_record:connection_states() | secret_printout(),
                  protocol_buffers :: term() | secret_printout(),
                  user_data_buffer ::
                      undefined | {[binary()], non_neg_integer(), [binary()]} | secret_printout(),
                  bytes_to_read :: undefined | integer(),
                  start_or_recv_from :: term(),
                  log_level :: term()}) ->
              gen_statem:state_function_result().

-spec downgrade(gen_statem:event_type(),
          term(),
          #state{static_env ::
                     #static_env{role :: client | server,
                                 transport_cb :: atom(),
                                 protocol_cb :: tls_gen_connection | dtls_gen_connection,
                                 data_tag :: atom(),
                                 close_tag :: atom(),
                                 error_tag :: atom(),
                                 passive_tag :: atom(),
                                 host :: string() | inet:ip_address(),
                                 port :: integer(),
                                 socket :: port() | tuple(),
                                 cert_db :: reference() | undefined,
                                 session_cache :: db_handle(),
                                 session_cache_cb :: atom(),
                                 crl_db :: term(),
                                 file_ref_db :: db_handle(),
                                 cert_db_ref :: certdb_ref() | undefined,
                                 trackers :: [{atom(), pid()}] | undefined},
                 connection_env ::
                     #connection_env{user_application :: {Monitor :: reference(), User :: pid()},
                                     downgrade ::
                                         {NewController :: pid(), From :: gen_statem:from()} |
                                         undefined,
                                     socket_terminated :: boolean(),
                                     socket_tls_closed :: boolean(),
                                     negotiated_version :: ssl_record:ssl_version() | undefined,
                                     erl_dist_handle :: erlang:dist_handle() | undefined,
                                     cert_key_alts ::
                                         #{eddsa => list(),
                                           ecdsa => list(),
                                           rsa_pss_pss => list(),
                                           rsa => list(),
                                           dsa => list()} |
                                         secret_printout() |
                                         undefined} |
                     secret_printout(),
                 ssl_options :: ssl_options(),
                 socket_options ::
                     #socket_options{mode :: term(),
                                     packet :: term(),
                                     packet_size :: term(),
                                     header :: term(),
                                     active :: term()},
                 handshake_env ::
                     #handshake_env{client_hello_version :: ssl_record:ssl_version() | undefined,
                                    unprocessed_handshake_events :: integer(),
                                    tls_handshake_history ::
                                        ssl_handshake:ssl_handshake_history() |
                                        secret_printout() |
                                        undefined,
                                    expecting_finished :: boolean(),
                                    renegotiation ::
                                        undefined | {boolean(), From :: term() | internal | peer},
                                    resumption :: boolean(),
                                    change_cipher_spec_sent :: boolean(),
                                    sni_guided_cert_selection :: boolean(),
                                    early_data_accepted :: boolean(),
                                    allow_renegotiate :: boolean(),
                                    continue_status :: term(),
                                    sni_hostname :: term(),
                                    max_frag_enum :: undefined | {max_frag_enum, integer()},
                                    expecting_next_protocol_negotiation :: boolean(),
                                    next_protocol :: undefined | binary(),
                                    alpn :: term(),
                                    negotiated_protocol :: term(),
                                    hashsign_algorithm :: term(),
                                    cert_hashsign_algorithm :: term(),
                                    kex_algorithm :: ssl:kex_algo(),
                                    kex_keys ::
                                        {PublicKey :: binary(), PrivateKey :: binary()} |
                                        #'ECPrivateKey'{version :: term(),
                                                        privateKey :: term(),
                                                        parameters :: term(),
                                                        publicKey :: term(),
                                                        attributes :: term()} |
                                        undefined |
                                        secret_printout(),
                                    diffie_hellman_params ::
                                        #'DHParameter'{prime :: term(),
                                                       base :: term(),
                                                       privateValueLength :: term()} |
                                        undefined |
                                        secret_printout(),
                                    srp_params ::
                                        #srp_user{generator :: binary(),
                                                  prime :: binary(),
                                                  salt :: binary(),
                                                  verifier :: binary()} |
                                        secret_printout() |
                                        undefined,
                                    public_key_info :: ssl_handshake:public_key_info() | undefined,
                                    premaster_secret :: binary() | secret_printout() | undefined,
                                    server_psk_identity :: binary() | undefined,
                                    cookie_iv_shard :: {binary(), binary()} | undefined,
                                    stapling_state :: term()} |
                     secret_printout(),
                 flight_buffer :: list() | map(),
                 client_certificate_status ::
                     not_requested | requested | empty | needs_verifying | verified,
                 protocol_specific :: map(),
                 session ::
                     #session{session_id :: term(),
                              internal_id :: term(),
                              peer_certificate :: term(),
                              own_certificates :: term(),
                              private_key :: term(),
                              cipher_suite :: term(),
                              master_secret :: term(),
                              srp_username :: term(),
                              is_resumable :: term(),
                              time_stamp :: term(),
                              ecc :: term(),
                              sign_alg :: term(),
                              dh_public_value :: term()} |
                     secret_printout(),
                 key_share :: term(),
                 connection_states :: ssl_record:connection_states() | secret_printout(),
                 protocol_buffers :: term() | secret_printout(),
                 user_data_buffer ::
                     undefined | {[binary()], non_neg_integer(), [binary()]} | secret_printout(),
                 bytes_to_read :: undefined | integer(),
                 start_or_recv_from :: term(),
                 log_level :: term()}) ->
             gen_statem:state_function_result().

-spec hello(gen_statem:event_type(),
      term(),
      #state{static_env ::
                 #static_env{role :: client | server,
                             transport_cb :: atom(),
                             protocol_cb :: tls_gen_connection | dtls_gen_connection,
                             data_tag :: atom(),
                             close_tag :: atom(),
                             error_tag :: atom(),
                             passive_tag :: atom(),
                             host :: string() | inet:ip_address(),
                             port :: integer(),
                             socket :: port() | tuple(),
                             cert_db :: reference() | undefined,
                             session_cache :: db_handle(),
                             session_cache_cb :: atom(),
                             crl_db :: term(),
                             file_ref_db :: db_handle(),
                             cert_db_ref :: certdb_ref() | undefined,
                             trackers :: [{atom(), pid()}] | undefined},
             connection_env ::
                 #connection_env{user_application :: {Monitor :: reference(), User :: pid()},
                                 downgrade ::
                                     {NewController :: pid(), From :: gen_statem:from()} |
                                     undefined,
                                 socket_terminated :: boolean(),
                                 socket_tls_closed :: boolean(),
                                 negotiated_version :: ssl_record:ssl_version() | undefined,
                                 erl_dist_handle :: erlang:dist_handle() | undefined,
                                 cert_key_alts ::
                                     #{eddsa => list(),
                                       ecdsa => list(),
                                       rsa_pss_pss => list(),
                                       rsa => list(),
                                       dsa => list()} |
                                     secret_printout() |
                                     undefined} |
                 secret_printout(),
             ssl_options :: ssl_options(),
             socket_options ::
                 #socket_options{mode :: term(),
                                 packet :: term(),
                                 packet_size :: term(),
                                 header :: term(),
                                 active :: term()},
             handshake_env ::
                 #handshake_env{client_hello_version :: ssl_record:ssl_version() | undefined,
                                unprocessed_handshake_events :: integer(),
                                tls_handshake_history ::
                                    ssl_handshake:ssl_handshake_history() |
                                    secret_printout() |
                                    undefined,
                                expecting_finished :: boolean(),
                                renegotiation ::
                                    undefined | {boolean(), From :: term() | internal | peer},
                                resumption :: boolean(),
                                change_cipher_spec_sent :: boolean(),
                                sni_guided_cert_selection :: boolean(),
                                early_data_accepted :: boolean(),
                                allow_renegotiate :: boolean(),
                                continue_status :: term(),
                                sni_hostname :: term(),
                                max_frag_enum :: undefined | {max_frag_enum, integer()},
                                expecting_next_protocol_negotiation :: boolean(),
                                next_protocol :: undefined | binary(),
                                alpn :: term(),
                                negotiated_protocol :: term(),
                                hashsign_algorithm :: term(),
                                cert_hashsign_algorithm :: term(),
                                kex_algorithm :: ssl:kex_algo(),
                                kex_keys ::
                                    {PublicKey :: binary(), PrivateKey :: binary()} |
                                    #'ECPrivateKey'{version :: term(),
                                                    privateKey :: term(),
                                                    parameters :: term(),
                                                    publicKey :: term(),
                                                    attributes :: term()} |
                                    undefined |
                                    secret_printout(),
                                diffie_hellman_params ::
                                    #'DHParameter'{prime :: term(),
                                                   base :: term(),
                                                   privateValueLength :: term()} |
                                    undefined |
                                    secret_printout(),
                                srp_params ::
                                    #srp_user{generator :: binary(),
                                              prime :: binary(),
                                              salt :: binary(),
                                              verifier :: binary()} |
                                    secret_printout() |
                                    undefined,
                                public_key_info :: ssl_handshake:public_key_info() | undefined,
                                premaster_secret :: binary() | secret_printout() | undefined,
                                server_psk_identity :: binary() | undefined,
                                cookie_iv_shard :: {binary(), binary()} | undefined,
                                stapling_state :: term()} |
                 secret_printout(),
             flight_buffer :: list() | map(),
             client_certificate_status ::
                 not_requested | requested | empty | needs_verifying | verified,
             protocol_specific :: map(),
             session ::
                 #session{session_id :: term(),
                          internal_id :: term(),
                          peer_certificate :: term(),
                          own_certificates :: term(),
                          private_key :: term(),
                          cipher_suite :: term(),
                          master_secret :: term(),
                          srp_username :: term(),
                          is_resumable :: term(),
                          time_stamp :: term(),
                          ecc :: term(),
                          sign_alg :: term(),
                          dh_public_value :: term()} |
                 secret_printout(),
             key_share :: term(),
             connection_states :: ssl_record:connection_states() | secret_printout(),
             protocol_buffers :: term() | secret_printout(),
             user_data_buffer ::
                 undefined | {[binary()], non_neg_integer(), [binary()]} | secret_printout(),
             bytes_to_read :: undefined | integer(),
             start_or_recv_from :: term(),
             log_level :: term()}) ->
         gen_statem:state_function_result().

-spec initial_hello(gen_statem:event_type(),
              {start, timeout()} | {start, {list(), list()}, timeout()} | term(),
              #state{static_env ::
                         #static_env{role :: client | server,
                                     transport_cb :: atom(),
                                     protocol_cb :: tls_gen_connection | dtls_gen_connection,
                                     data_tag :: atom(),
                                     close_tag :: atom(),
                                     error_tag :: atom(),
                                     passive_tag :: atom(),
                                     host :: string() | inet:ip_address(),
                                     port :: integer(),
                                     socket :: port() | tuple(),
                                     cert_db :: reference() | undefined,
                                     session_cache :: db_handle(),
                                     session_cache_cb :: atom(),
                                     crl_db :: term(),
                                     file_ref_db :: db_handle(),
                                     cert_db_ref :: certdb_ref() | undefined,
                                     trackers :: [{atom(), pid()}] | undefined},
                     connection_env ::
                         #connection_env{user_application ::
                                             {Monitor :: reference(), User :: pid()},
                                         downgrade ::
                                             {NewController :: pid(), From :: gen_statem:from()} |
                                             undefined,
                                         socket_terminated :: boolean(),
                                         socket_tls_closed :: boolean(),
                                         negotiated_version ::
                                             ssl_record:ssl_version() | undefined,
                                         erl_dist_handle :: erlang:dist_handle() | undefined,
                                         cert_key_alts ::
                                             #{eddsa => list(),
                                               ecdsa => list(),
                                               rsa_pss_pss => list(),
                                               rsa => list(),
                                               dsa => list()} |
                                             secret_printout() |
                                             undefined} |
                         secret_printout(),
                     ssl_options :: ssl_options(),
                     socket_options ::
                         #socket_options{mode :: term(),
                                         packet :: term(),
                                         packet_size :: term(),
                                         header :: term(),
                                         active :: term()},
                     handshake_env ::
                         #handshake_env{client_hello_version ::
                                            ssl_record:ssl_version() | undefined,
                                        unprocessed_handshake_events :: integer(),
                                        tls_handshake_history ::
                                            ssl_handshake:ssl_handshake_history() |
                                            secret_printout() |
                                            undefined,
                                        expecting_finished :: boolean(),
                                        renegotiation ::
                                            undefined |
                                            {boolean(), From :: term() | internal | peer},
                                        resumption :: boolean(),
                                        change_cipher_spec_sent :: boolean(),
                                        sni_guided_cert_selection :: boolean(),
                                        early_data_accepted :: boolean(),
                                        allow_renegotiate :: boolean(),
                                        continue_status :: term(),
                                        sni_hostname :: term(),
                                        max_frag_enum :: undefined | {max_frag_enum, integer()},
                                        expecting_next_protocol_negotiation :: boolean(),
                                        next_protocol :: undefined | binary(),
                                        alpn :: term(),
                                        negotiated_protocol :: term(),
                                        hashsign_algorithm :: term(),
                                        cert_hashsign_algorithm :: term(),
                                        kex_algorithm :: ssl:kex_algo(),
                                        kex_keys ::
                                            {PublicKey :: binary(), PrivateKey :: binary()} |
                                            #'ECPrivateKey'{version :: term(),
                                                            privateKey :: term(),
                                                            parameters :: term(),
                                                            publicKey :: term(),
                                                            attributes :: term()} |
                                            undefined |
                                            secret_printout(),
                                        diffie_hellman_params ::
                                            #'DHParameter'{prime :: term(),
                                                           base :: term(),
                                                           privateValueLength :: term()} |
                                            undefined |
                                            secret_printout(),
                                        srp_params ::
                                            #srp_user{generator :: binary(),
                                                      prime :: binary(),
                                                      salt :: binary(),
                                                      verifier :: binary()} |
                                            secret_printout() |
                                            undefined,
                                        public_key_info ::
                                            ssl_handshake:public_key_info() | undefined,
                                        premaster_secret ::
                                            binary() | secret_printout() | undefined,
                                        server_psk_identity :: binary() | undefined,
                                        cookie_iv_shard :: {binary(), binary()} | undefined,
                                        stapling_state :: term()} |
                         secret_printout(),
                     flight_buffer :: list() | map(),
                     client_certificate_status ::
                         not_requested | requested | empty | needs_verifying | verified,
                     protocol_specific :: map(),
                     session ::
                         #session{session_id :: term(),
                                  internal_id :: term(),
                                  peer_certificate :: term(),
                                  own_certificates :: term(),
                                  private_key :: term(),
                                  cipher_suite :: term(),
                                  master_secret :: term(),
                                  srp_username :: term(),
                                  is_resumable :: term(),
                                  time_stamp :: term(),
                                  ecc :: term(),
                                  sign_alg :: term(),
                                  dh_public_value :: term()} |
                         secret_printout(),
                     key_share :: term(),
                     connection_states :: ssl_record:connection_states() | secret_printout(),
                     protocol_buffers :: term() | secret_printout(),
                     user_data_buffer ::
                         undefined |
                         {[binary()], non_neg_integer(), [binary()]} |
                         secret_printout(),
                     bytes_to_read :: undefined | integer(),
                     start_or_recv_from :: term(),
                     log_level :: term()}) ->
                 gen_statem:state_function_result().

-spec user_hello(gen_statem:event_type(),
           term(),
           #state{static_env ::
                      #static_env{role :: client | server,
                                  transport_cb :: atom(),
                                  protocol_cb :: tls_gen_connection | dtls_gen_connection,
                                  data_tag :: atom(),
                                  close_tag :: atom(),
                                  error_tag :: atom(),
                                  passive_tag :: atom(),
                                  host :: string() | inet:ip_address(),
                                  port :: integer(),
                                  socket :: port() | tuple(),
                                  cert_db :: reference() | undefined,
                                  session_cache :: db_handle(),
                                  session_cache_cb :: atom(),
                                  crl_db :: term(),
                                  file_ref_db :: db_handle(),
                                  cert_db_ref :: certdb_ref() | undefined,
                                  trackers :: [{atom(), pid()}] | undefined},
                  connection_env ::
                      #connection_env{user_application :: {Monitor :: reference(), User :: pid()},
                                      downgrade ::
                                          {NewController :: pid(), From :: gen_statem:from()} |
                                          undefined,
                                      socket_terminated :: boolean(),
                                      socket_tls_closed :: boolean(),
                                      negotiated_version :: ssl_record:ssl_version() | undefined,
                                      erl_dist_handle :: erlang:dist_handle() | undefined,
                                      cert_key_alts ::
                                          #{eddsa => list(),
                                            ecdsa => list(),
                                            rsa_pss_pss => list(),
                                            rsa => list(),
                                            dsa => list()} |
                                          secret_printout() |
                                          undefined} |
                      secret_printout(),
                  ssl_options :: ssl_options(),
                  socket_options ::
                      #socket_options{mode :: term(),
                                      packet :: term(),
                                      packet_size :: term(),
                                      header :: term(),
                                      active :: term()},
                  handshake_env ::
                      #handshake_env{client_hello_version :: ssl_record:ssl_version() | undefined,
                                     unprocessed_handshake_events :: integer(),
                                     tls_handshake_history ::
                                         ssl_handshake:ssl_handshake_history() |
                                         secret_printout() |
                                         undefined,
                                     expecting_finished :: boolean(),
                                     renegotiation ::
                                         undefined | {boolean(), From :: term() | internal | peer},
                                     resumption :: boolean(),
                                     change_cipher_spec_sent :: boolean(),
                                     sni_guided_cert_selection :: boolean(),
                                     early_data_accepted :: boolean(),
                                     allow_renegotiate :: boolean(),
                                     continue_status :: term(),
                                     sni_hostname :: term(),
                                     max_frag_enum :: undefined | {max_frag_enum, integer()},
                                     expecting_next_protocol_negotiation :: boolean(),
                                     next_protocol :: undefined | binary(),
                                     alpn :: term(),
                                     negotiated_protocol :: term(),
                                     hashsign_algorithm :: term(),
                                     cert_hashsign_algorithm :: term(),
                                     kex_algorithm :: ssl:kex_algo(),
                                     kex_keys ::
                                         {PublicKey :: binary(), PrivateKey :: binary()} |
                                         #'ECPrivateKey'{version :: term(),
                                                         privateKey :: term(),
                                                         parameters :: term(),
                                                         publicKey :: term(),
                                                         attributes :: term()} |
                                         undefined |
                                         secret_printout(),
                                     diffie_hellman_params ::
                                         #'DHParameter'{prime :: term(),
                                                        base :: term(),
                                                        privateValueLength :: term()} |
                                         undefined |
                                         secret_printout(),
                                     srp_params ::
                                         #srp_user{generator :: binary(),
                                                   prime :: binary(),
                                                   salt :: binary(),
                                                   verifier :: binary()} |
                                         secret_printout() |
                                         undefined,
                                     public_key_info ::
                                         ssl_handshake:public_key_info() | undefined,
                                     premaster_secret :: binary() | secret_printout() | undefined,
                                     server_psk_identity :: binary() | undefined,
                                     cookie_iv_shard :: {binary(), binary()} | undefined,
                                     stapling_state :: term()} |
                      secret_printout(),
                  flight_buffer :: list() | map(),
                  client_certificate_status ::
                      not_requested | requested | empty | needs_verifying | verified,
                  protocol_specific :: map(),
                  session ::
                      #session{session_id :: term(),
                               internal_id :: term(),
                               peer_certificate :: term(),
                               own_certificates :: term(),
                               private_key :: term(),
                               cipher_suite :: term(),
                               master_secret :: term(),
                               srp_username :: term(),
                               is_resumable :: term(),
                               time_stamp :: term(),
                               ecc :: term(),
                               sign_alg :: term(),
                               dh_public_value :: term()} |
                      secret_printout(),
                  key_share :: term(),
                  connection_states :: ssl_record:connection_states() | secret_printout(),
                  protocol_buffers :: term() | secret_printout(),
                  user_data_buffer ::
                      undefined | {[binary()], non_neg_integer(), [binary()]} | secret_printout(),
                  bytes_to_read :: undefined | integer(),
                  start_or_recv_from :: term(),
                  log_level :: term()}) ->
              gen_statem:state_function_result().

-spec wait_cert_verify(gen_statem:event_type(),
                 #hello_request{} |
                 #certificate_verify{hashsign_algorithm :: term(), signature :: term()} |
                 term(),
                 #state{static_env ::
                            #static_env{role :: client | server,
                                        transport_cb :: atom(),
                                        protocol_cb :: tls_gen_connection | dtls_gen_connection,
                                        data_tag :: atom(),
                                        close_tag :: atom(),
                                        error_tag :: atom(),
                                        passive_tag :: atom(),
                                        host :: string() | inet:ip_address(),
                                        port :: integer(),
                                        socket :: port() | tuple(),
                                        cert_db :: reference() | undefined,
                                        session_cache :: db_handle(),
                                        session_cache_cb :: atom(),
                                        crl_db :: term(),
                                        file_ref_db :: db_handle(),
                                        cert_db_ref :: certdb_ref() | undefined,
                                        trackers :: [{atom(), pid()}] | undefined},
                        connection_env ::
                            #connection_env{user_application ::
                                                {Monitor :: reference(), User :: pid()},
                                            downgrade ::
                                                {NewController :: pid(),
                                                 From :: gen_statem:from()} |
                                                undefined,
                                            socket_terminated :: boolean(),
                                            socket_tls_closed :: boolean(),
                                            negotiated_version ::
                                                ssl_record:ssl_version() | undefined,
                                            erl_dist_handle :: erlang:dist_handle() | undefined,
                                            cert_key_alts ::
                                                #{eddsa => list(),
                                                  ecdsa => list(),
                                                  rsa_pss_pss => list(),
                                                  rsa => list(),
                                                  dsa => list()} |
                                                secret_printout() |
                                                undefined} |
                            secret_printout(),
                        ssl_options :: ssl_options(),
                        socket_options ::
                            #socket_options{mode :: term(),
                                            packet :: term(),
                                            packet_size :: term(),
                                            header :: term(),
                                            active :: term()},
                        handshake_env ::
                            #handshake_env{client_hello_version ::
                                               ssl_record:ssl_version() | undefined,
                                           unprocessed_handshake_events :: integer(),
                                           tls_handshake_history ::
                                               ssl_handshake:ssl_handshake_history() |
                                               secret_printout() |
                                               undefined,
                                           expecting_finished :: boolean(),
                                           renegotiation ::
                                               undefined |
                                               {boolean(), From :: term() | internal | peer},
                                           resumption :: boolean(),
                                           change_cipher_spec_sent :: boolean(),
                                           sni_guided_cert_selection :: boolean(),
                                           early_data_accepted :: boolean(),
                                           allow_renegotiate :: boolean(),
                                           continue_status :: term(),
                                           sni_hostname :: term(),
                                           max_frag_enum :: undefined | {max_frag_enum, integer()},
                                           expecting_next_protocol_negotiation :: boolean(),
                                           next_protocol :: undefined | binary(),
                                           alpn :: term(),
                                           negotiated_protocol :: term(),
                                           hashsign_algorithm :: term(),
                                           cert_hashsign_algorithm :: term(),
                                           kex_algorithm :: ssl:kex_algo(),
                                           kex_keys ::
                                               {PublicKey :: binary(), PrivateKey :: binary()} |
                                               #'ECPrivateKey'{version :: term(),
                                                               privateKey :: term(),
                                                               parameters :: term(),
                                                               publicKey :: term(),
                                                               attributes :: term()} |
                                               undefined |
                                               secret_printout(),
                                           diffie_hellman_params ::
                                               #'DHParameter'{prime :: term(),
                                                              base :: term(),
                                                              privateValueLength :: term()} |
                                               undefined |
                                               secret_printout(),
                                           srp_params ::
                                               #srp_user{generator :: binary(),
                                                         prime :: binary(),
                                                         salt :: binary(),
                                                         verifier :: binary()} |
                                               secret_printout() |
                                               undefined,
                                           public_key_info ::
                                               ssl_handshake:public_key_info() | undefined,
                                           premaster_secret ::
                                               binary() | secret_printout() | undefined,
                                           server_psk_identity :: binary() | undefined,
                                           cookie_iv_shard :: {binary(), binary()} | undefined,
                                           stapling_state :: term()} |
                            secret_printout(),
                        flight_buffer :: list() | map(),
                        client_certificate_status ::
                            not_requested | requested | empty | needs_verifying | verified,
                        protocol_specific :: map(),
                        session ::
                            #session{session_id :: term(),
                                     internal_id :: term(),
                                     peer_certificate :: term(),
                                     own_certificates :: term(),
                                     private_key :: term(),
                                     cipher_suite :: term(),
                                     master_secret :: term(),
                                     srp_username :: term(),
                                     is_resumable :: term(),
                                     time_stamp :: term(),
                                     ecc :: term(),
                                     sign_alg :: term(),
                                     dh_public_value :: term()} |
                            secret_printout(),
                        key_share :: term(),
                        connection_states :: ssl_record:connection_states() | secret_printout(),
                        protocol_buffers :: term() | secret_printout(),
                        user_data_buffer ::
                            undefined |
                            {[binary()], non_neg_integer(), [binary()]} |
                            secret_printout(),
                        bytes_to_read :: undefined | integer(),
                        start_or_recv_from :: term(),
                        log_level :: term()}) ->
                    gen_statem:state_function_result().