diff --git a/src/tls/asn1.c b/src/tls/asn1.c
index cec1092..822f87c 100644
--- a/src/tls/asn1.c
+++ b/src/tls/asn1.c
@@ -31,6 +31,10 @@
 	pos = buf;
 	end = buf + len;
 
+	if (pos >= end) {
+		wpa_printf(MSG_DEBUG, "ASN.1: No room for Identifier");
+		return -1;
+	}
 	hdr->identifier = *pos++;
 	hdr->class = hdr->identifier >> 6;
 	hdr->constructed = !!(hdr->identifier & (1 << 5));
@@ -51,6 +55,10 @@
 	} else
 		hdr->tag = hdr->identifier & 0x1f;
 
+	if (pos >= end) {
+		wpa_printf(MSG_DEBUG, "ASN.1: No room for Length");
+		return -1;
+	}
 	tmp = *pos++;
 	if (tmp & 0x80) {
 		if (tmp == 0xff) {
diff --git a/src/tls/tlsv1_client_read.c b/src/tls/tlsv1_client_read.c
index e66f1a9..80874e5 100644
--- a/src/tls/tlsv1_client_read.c
+++ b/src/tls/tlsv1_client_read.c
@@ -290,7 +290,7 @@
 		return;
 
 	os_memset(&ev, 0, sizeof(ev));
-	if (conn->cred->cert_probe || conn->cert_in_cb) {
+	if ((conn->cred && conn->cred->cert_probe) || conn->cert_in_cb) {
 		cert_buf = wpabuf_alloc_copy(cert->cert_start,
 					     cert->cert_len);
 		ev.peer_cert.cert = cert_buf;
diff --git a/src/tls/tlsv1_client_write.c b/src/tls/tlsv1_client_write.c
index 04d895e..4a1147b 100644
--- a/src/tls/tlsv1_client_write.c
+++ b/src/tls/tlsv1_client_write.c
@@ -72,6 +72,9 @@
 	*out_len = 0;
 
 	os_get_time(&now);
+#ifdef TEST_FUZZ
+	now.sec = 0xfffefdfc;
+#endif /* TEST_FUZZ */
 	WPA_PUT_BE32(conn->client_random, now.sec);
 	if (random_get_bytes(conn->client_random + 4, TLS_RANDOM_LEN - 4)) {
 		wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
diff --git a/src/tls/tlsv1_server.c b/src/tls/tlsv1_server.c
index 5406969..4759509 100644
--- a/src/tls/tlsv1_server.c
+++ b/src/tls/tlsv1_server.c
@@ -164,7 +164,8 @@
 			/* need more data */
 			wpa_printf(MSG_DEBUG, "TLSv1: Partial processing not "
 				   "yet supported");
-			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL, alert);
+			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
+					   TLS_ALERT_INTERNAL_ERROR);
 			goto failed;
 		}
 		ct = pos[0];
@@ -204,6 +205,7 @@
 		msg = tlsv1_server_send_alert(conn, conn->alert_level,
 					      conn->alert_description,
 					      out_len);
+		conn->write_alerts++;
 	}
 
 	return msg;
@@ -296,6 +298,7 @@
 			}
 			tlsv1_server_log(conn, "Received alert %d:%d",
 					 out_pos[0], out_pos[1]);
+			conn->read_alerts++;
 			if (out_pos[0] == TLS_ALERT_LEVEL_WARNING) {
 				/* Continue processing */
 				pos += used;
@@ -708,6 +711,24 @@
 }
 
 
+int tlsv1_server_get_failed(struct tlsv1_server *conn)
+{
+	return conn->state == FAILED;
+}
+
+
+int tlsv1_server_get_read_alerts(struct tlsv1_server *conn)
+{
+	return conn->read_alerts;
+}
+
+
+int tlsv1_server_get_write_alerts(struct tlsv1_server *conn)
+{
+	return conn->write_alerts;
+}
+
+
 #ifdef CONFIG_TESTING_OPTIONS
 void tlsv1_server_set_test_flags(struct tlsv1_server *conn, u32 flags)
 {
diff --git a/src/tls/tlsv1_server.h b/src/tls/tlsv1_server.h
index 10e7699..c3fd37e 100644
--- a/src/tls/tlsv1_server.h
+++ b/src/tls/tlsv1_server.h
@@ -48,6 +48,10 @@
 void tlsv1_server_set_log_cb(struct tlsv1_server *conn,
 			     void (*cb)(void *ctx, const char *msg), void *ctx);
 
+int tlsv1_server_get_failed(struct tlsv1_server *conn);
+int tlsv1_server_get_read_alerts(struct tlsv1_server *conn);
+int tlsv1_server_get_write_alerts(struct tlsv1_server *conn);
+
 void tlsv1_server_set_test_flags(struct tlsv1_server *conn, u32 flags);
 
 #endif /* TLSV1_SERVER_H */
diff --git a/src/tls/tlsv1_server_i.h b/src/tls/tlsv1_server_i.h
index 29c6678..2622585 100644
--- a/src/tls/tlsv1_server_i.h
+++ b/src/tls/tlsv1_server_i.h
@@ -30,6 +30,8 @@
 	u8 alert_level;
 	u8 alert_description;
 
+	int read_alerts, write_alerts;
+
 	struct crypto_public_key *client_rsa_key;
 
 	struct tls_verify_hash verify;
diff --git a/src/tls/tlsv1_server_read.c b/src/tls/tlsv1_server_read.c
index 4aa8a01..e957678 100644
--- a/src/tls/tlsv1_server_read.c
+++ b/src/tls/tlsv1_server_read.c
@@ -139,8 +139,11 @@
 	pos = in_data;
 	left = *in_len;
 
-	if (left < 4)
+	if (left < 4) {
+		tlsv1_server_log(conn,
+				 "Truncated handshake message (expected ClientHello)");
 		goto decode_error;
+	}
 
 	/* HandshakeType msg_type */
 	if (*pos != TLS_HANDSHAKE_TYPE_CLIENT_HELLO) {
@@ -157,8 +160,12 @@
 	pos += 3;
 	left -= 4;
 
-	if (len > left)
+	if (len > left) {
+		tlsv1_server_log(conn,
+				 "Truncated ClientHello (len=%d left=%d)",
+				 (int) len, (int) left);
 		goto decode_error;
+	}
 
 	/* body - ClientHello */
 
@@ -166,8 +173,10 @@
 	end = pos + len;
 
 	/* ProtocolVersion client_version */
-	if (end - pos < 2)
+	if (end - pos < 2) {
+		tlsv1_server_log(conn, "Truncated ClientHello/client_version");
 		goto decode_error;
+	}
 	conn->client_version = WPA_GET_BE16(pos);
 	tlsv1_server_log(conn, "Client version %d.%d",
 			 conn->client_version >> 8,
@@ -196,8 +205,10 @@
 			 tls_version_str(conn->rl.tls_version));
 
 	/* Random random */
-	if (end - pos < TLS_RANDOM_LEN)
+	if (end - pos < TLS_RANDOM_LEN) {
+		tlsv1_server_log(conn, "Truncated ClientHello/client_random");
 		goto decode_error;
+	}
 
 	os_memcpy(conn->client_random, pos, TLS_RANDOM_LEN);
 	pos += TLS_RANDOM_LEN;
@@ -205,25 +216,36 @@
 		    conn->client_random, TLS_RANDOM_LEN);
 
 	/* SessionID session_id */
-	if (end - pos < 1)
+	if (end - pos < 1) {
+		tlsv1_server_log(conn, "Truncated ClientHello/session_id len");
 		goto decode_error;
-	if (end - pos < 1 + *pos || *pos > TLS_SESSION_ID_MAX_LEN)
+	}
+	if (end - pos < 1 + *pos || *pos > TLS_SESSION_ID_MAX_LEN) {
+		tlsv1_server_log(conn, "Truncated ClientHello/session_id");
 		goto decode_error;
+	}
 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: client session_id", pos + 1, *pos);
 	pos += 1 + *pos;
 	/* TODO: add support for session resumption */
 
 	/* CipherSuite cipher_suites<2..2^16-1> */
-	if (end - pos < 2)
+	if (end - pos < 2) {
+		tlsv1_server_log(conn,
+				 "Truncated ClientHello/cipher_suites len");
 		goto decode_error;
+	}
 	num_suites = WPA_GET_BE16(pos);
 	pos += 2;
-	if (end - pos < num_suites)
+	if (end - pos < num_suites) {
+		tlsv1_server_log(conn, "Truncated ClientHello/cipher_suites");
 		goto decode_error;
+	}
 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: client cipher suites",
 		    pos, num_suites);
-	if (num_suites & 1)
+	if (num_suites & 1) {
+		tlsv1_server_log(conn, "Odd len ClientHello/cipher_suites");
 		goto decode_error;
+	}
 	num_suites /= 2;
 
 	cipher_suite = 0;
@@ -259,11 +281,17 @@
 	conn->cipher_suite = cipher_suite;
 
 	/* CompressionMethod compression_methods<1..2^8-1> */
-	if (end - pos < 1)
+	if (end - pos < 1) {
+		tlsv1_server_log(conn,
+				 "Truncated ClientHello/compression_methods len");
 		goto decode_error;
+	}
 	num_suites = *pos++;
-	if (end - pos < num_suites)
+	if (end - pos < num_suites) {
+		tlsv1_server_log(conn,
+				 "Truncated ClientHello/compression_methods");
 		goto decode_error;
+	}
 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: client compression_methods",
 		    pos, num_suites);
 	compr_null_found = 0;
@@ -1217,6 +1245,7 @@
 
 	if (os_memcmp_const(pos, verify_data, TLS_VERIFY_DATA_LEN) != 0) {
 		tlsv1_server_log(conn, "Mismatch in verify_data");
+		conn->state = FAILED;
 		return -1;
 	}
 
diff --git a/src/tls/tlsv1_server_write.c b/src/tls/tlsv1_server_write.c
index bdc6c11..8d36cf1 100644
--- a/src/tls/tlsv1_server_write.c
+++ b/src/tls/tlsv1_server_write.c
@@ -26,7 +26,7 @@
 	size_t len = 0;
 	struct x509_certificate *cert;
 
-	cert = conn->cred->cert;
+	cert = conn->cred ? conn->cred->cert : NULL;
 	while (cert) {
 		len += 3 + cert->cert_len;
 		if (x509_certificate_self_signed(cert))
@@ -53,6 +53,9 @@
 	pos += TLS_RECORD_HEADER_LEN;
 
 	os_get_time(&now);
+#ifdef TEST_FUZZ
+	now.sec = 0xfffefdfc;
+#endif /* TEST_FUZZ */
 	WPA_PUT_BE32(conn->server_random, now.sec);
 	if (random_get_bytes(conn->server_random + 4, TLS_RANDOM_LEN - 4)) {
 		wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
diff --git a/src/tls/x509v3.c b/src/tls/x509v3.c
index f80c9a3..fa4d442 100644
--- a/src/tls/x509v3.c
+++ b/src/tls/x509v3.c
@@ -532,6 +532,8 @@
 	}
 
 done:
+	if (pos < end)
+		*pos = '\0';
 	end[-1] = '\0';
 }