diff --git a/CHANGES b/CHANGES
index 0a47d74..0c6fd66 100644
--- a/CHANGES
+++ b/CHANGES
@@ -64,6 +64,10 @@ porting:
 	Socat included <sys/poll.h> instead of POSIX <poll.h>
 	Thanks to John Spencer for reporting this issue.
 
+testing:
+	Do not distribute testcert.conf with socat source but generate it
+	(and new testcert6.conf) during test.sh run.
+
 ####################### V 1.7.2.4:
 
 corrections:
diff --git a/Makefile.in b/Makefile.in
index 2d5053e..01f11f9 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -77,7 +77,7 @@ DOCFILES = README README.FIPS CHANGES FILES EXAMPLES PORTING SECURITY DEVELOPMEN
 SHFILES = daemon.sh mail.sh ftp.sh readline.sh \
 	socat_buildscript_for_android.sh
 TESTFILES = test.sh socks4echo.sh proxyecho.sh gatherinfo.sh readline-test.sh \
-	proxy.sh socks4a-echo.sh testcert.conf
+	proxy.sh socks4a-echo.sh
 OSFILES = Config/Makefile.Linux-2-6-24 Config/config.Linux-2-6-24.h \
 	Config/Makefile.SunOS-5-10 Config/config.SunOS-5-10.h \
 	Config/Makefile.FreeBSD-6-1 Config/config.FreeBSD-6-1.h \
diff --git a/test.sh b/test.sh
index 35af6b5..0ee2c96 100755
--- a/test.sh
+++ b/test.sh
@@ -78,18 +78,48 @@ LOCALHOST6=[::1]
 PROTO=$((144+RANDOM/2048))
 PORT=12002
 SOURCEPORT=2002
+
+# SSL certificate contents
 TESTCERT_CONF=testcert.conf
 TESTCERT6_CONF=testcert6.conf
-# keep these values consistent with testcert.conf
+#
 TESTCERT_COMMONNAME="$LOCALHOST"
-TESTCERT_COUNTRYNAME="$(grep ^countryName= testcert.conf)"; TESTCERT_COUNTRYNAME="${TESTCERT_COUNTRYNAME##*=}"
-TESTCERT_LOCALITYNAME="$(grep ^L= testcert.conf)"; TESTCERT_LOCALITYNAME="${TESTCERT_LOCALITYNAME##*=}"
-TESTCERT_ORGANIZATIONALUNITNAME="$(grep ^OU= testcert.conf)"; TESTCERT_ORGANIZATIONALUNITNAME="${TESTCERT_ORGANIZATIONALUNITNAME##*=}"
-TESTCERT_ORGANIZATIONNAME="$(grep ^O= testcert.conf)"; TESTCERT_ORGANIZATIONNAME="${TESTCERT_ORGANIZATIONNAME##*=}"
-TESTCERT_SUBJECT="C = XY, CN = localhost, O = dest-unreach, OU = socat, L = Lunar Base"
-TESTCERT_ISSUER="C = XY, CN = localhost, O = dest-unreach, OU = socat, L = Lunar Base"
-CAT=cat
-OD_C="od -c"
+TESTCERT_COMMONNAME6="$LOCALHOST6"
+TESTCERT_COUNTRYNAME="XY"
+TESTCERT_LOCALITYNAME="Lunar Base"
+TESTCERT_ORGANIZATIONALUNITNAME="socat"
+TESTCERT_ORGANIZATIONNAME="dest-unreach"
+TESTCERT_SUBJECT="C = $TESTCERT_COUNTRYNAME, CN = $TESTCERT_COMMONNAME, O = $TESTCERT_ORGANIZATIONNAME, OU = $TESTCERT_ORGANIZATIONALUNITNAME, L = $TESTCERT_LOCALITYNAME"
+TESTCERT_ISSUER="C = $TESTCERT_COUNTRYNAME, CN = $TESTCERT_COMMONNAME, O = $TESTCERT_ORGANIZATIONNAME, OU = $TESTCERT_ORGANIZATIONALUNITNAME, L = $TESTCERT_LOCALITYNAME"
+cat >$TESTCERT_CONF <<EOF
+prompt=no
+
+[ req ]
+default_bits = 768
+distinguished_name=Test
+
+[ Test ]
+countryName=$TESTCERT_COUNTRYNAME
+commonName=$TESTCERT_COMMONNAME
+O=$TESTCERT_ORGANIZATIONNAME
+OU=$TESTCERT_ORGANIZATIONALUNITNAME
+L=$TESTCERT_LOCALITYNAME
+EOF
+
+cat >$TESTCERT6_CONF <<EOF
+prompt=no
+
+[ req ]
+default_bits = 768
+distinguished_name=Test
+
+[ Test ]
+countryName=$TESTCERT_COUNTRYNAME
+commonName=$TESTCERT_COMMONNAME6
+O=$TESTCERT_ORGANIZATIONNAME
+OU=$TESTCERT_ORGANIZATIONALUNITNAME
+L=$TESTCERT_LOCALITYNAME
+EOF
 
 # clean up from previous runs
 rm -f testcli.{crt,key,pem}
@@ -97,6 +127,10 @@ rm -f testsrv.{crt,key,pem}
 rm -f testcli6.{crt,key,pem}
 rm -f testsrv6.{crt,key,pem}
 
+
+CAT=cat
+OD_C="od -c"
+
 # precision sleep; takes seconds with fractional part
 psleep () {
     local T="$1"
diff --git a/testcert.conf b/testcert.conf
index 44dbd5a..cc42f38 100644
--- a/testcert.conf
+++ b/testcert.conf
@@ -10,4 +10,3 @@ commonName=localhost
 O=dest-unreach
 OU=socat
 L=Lunar Base
-