diff --git a/src/tlsrequest.c b/src/tlsrequest.c

index 3e6f420..ae38688 100644

--- a/src/tlsrequest.c

+++ b/src/tlsrequest.c

@@ -155,7 +155,9 @@ static iTlsCertificate *maybeReuseSession_Context_(iContext *d, SSL *ssl, const

 iForEach(StringHash, i, d->cache) {

     iCachedSession *cs = i.value->object;

     if (isExpired_CachedSession_(cs)) {

- iDebug("[TlsRequest] session for %s has expired\n", cstr_Block(&i.value->keyBlock));

+ iDebug("[%s] session for %s has expired\n",

+ cstr_String(name_Thread(current_Thread())),

+ cstr_Block(&i.value->keyBlock));

         remove_StringHashIterator(&i);

     }

 }

@@ -164,7 +166,9 @@ static iTlsCertificate *maybeReuseSession_Context_(iContext *d, SSL *ssl, const

            cmp_Block(&cs->clientHash, clientHash) == 0)) {

     reuse_CachedSession(cs, ssl);

     cert = copy_TlsCertificate(cs->cert);

- iDebug("[TlsRequest] reusing session for %s\n", cstr_String(key));

+ iDebug("[%s] reusing session for %s\n",

+ cstr_String(name_Thread(current_Thread())),

+ cstr_String(key));

 }

 unlock_Mutex(&d->cacheMutex);

 delete_String(key);

@@ -176,15 +180,17 @@ static void saveSession_Context_(iContext *d, const iString *host, uint16_t port

                              SSL_SESSION *sess, const iTlsCertificate *serverCert,

                              const iTlsCertificate *clientCert) {

 if (sess && serverCert) {

+ const char *tname = cstr_String(name_Thread(current_Thread()));

+ iDebug("[%s] saveSession: host=%s port=%u\n", tname, cstr_String(host), port);

     iString *key = cacheKey_(host, port);

- lock_Mutex(&d->cacheMutex);

     iCachedSession *cs = new_CachedSession(sess, serverCert);

     if (clientCert) {

         setClientCertificate_CachedSession_(cs, clientCert);

     }

+ lock_Mutex(&d->cacheMutex);

     insert_StringHash(d->cache, key, cs);

     unlock_Mutex(&d->cacheMutex);

- iDebug("[TlsRequest] saved session for %s\n", cstr_String(key));

+ iDebug("[%s] saved session for %s\n", tname, cstr_String(key));

     delete_String(key);

 }

}

@@ -232,6 +238,7 @@ static int verifyCallback_Context_(int preverifyOk, X509_STORE_CTX *storeCtx) {

}



void init_Context(iContext *d) {

+ iAssert(current_Thread() == NULL); /* must be main thread */

 init_String(&d->libraryName);

#if defined (LIBRESSL_VERSION_TEXT)

 setCStr_String(&d->libraryName, "LibreSSL");

@@ -304,9 +311,11 @@ void setVerifyFunc_TlsRequest(iTlsRequestVerifyFunc verifyFunc) {

iDefineTypeConstruction(Context)



static void globalCleanup_TlsRequest_(void) {

+#if !defined (iPlatformAndroid)

 if (context_) {

     delete_Context(context_);

 }

+#endif

}



static void initContext_(void) {

@@ -323,10 +332,31 @@ struct Impl_TlsCertificate {

 STACK_OF(X509) *chain;

 EVP_PKEY *pkey;

 enum iTlsCertificateVerifyStatus *cachedVerifyStatus; /* TODO: include domain/IP check, too? */

+ char fingerprint[SHA256_DIGEST_LENGTH];

};



iDefineTypeConstruction(TlsCertificate)



+static void calcSHA256_(BIO *src, void *sha256_out) {

+ iBlock der;

+ init_Block(&der, 0);

+ readAllFromBIO_(src, &der);

+ SHA256(constData_Block(&der), size_Block(&der), sha256_out);

+ deinit_Block(&der);

+}

+

+static void updateFingerprint_TlsCertificate_(iTlsCertificate *d) {

+ if (d->cert) {

+ BIO *buf = BIO_new(BIO_s_mem());

+ i2d_X509_bio(buf, d->cert);

+ calcSHA256_(buf, d->fingerprint);

+ BIO_free(buf);

+ }

+ else {

+ iZap(d->fingerprint);

+ }

+}

+

void init_TlsCertificate(iTlsCertificate *d) {

 initContext_();

 d->cert  = NULL;

@@ -334,6 +364,7 @@ void init_TlsCertificate(iTlsCertificate *d) {

 d->pkey  = NULL;

 d->cachedVerifyStatus = malloc(sizeof(*d->cachedVerifyStatus));

 *d->cachedVerifyStatus = unknown_TlsCertificateVerifyStatus;

+ iZap(d->fingerprint);

}



static void freeX509Chain_(STACK_OF(X509) *chain) {

@@ -362,6 +393,7 @@ static iTlsCertificate *newX509Chain_TlsCertificate_(X509 *cert, STACK_OF(X509)

 iTlsCertificate *d = new_TlsCertificate();

 d->cert  = cert;

 d->chain = chain;

+ updateFingerprint_TlsCertificate_(d);

 return d;

}



@@ -370,6 +402,7 @@ iTlsCertificate *newPem_TlsCertificate(const iString *pem) {

 BIO *buf = BIO_new_mem_buf(cstr_String(pem), (int) size_String(pem));

 PEM_read_bio_X509(buf, &d->cert, NULL /* no passphrase callback */, "" /* empty passphrase */);

 BIO_free(buf);

+ updateFingerprint_TlsCertificate_(d);

 return d;

}



@@ -378,6 +411,7 @@ iTlsCertificate *newPemKey_TlsCertificate(const iString *certPem, const iString

 BIO *buf = BIO_new_mem_buf(cstr_String(keyPem), (int) size_String(keyPem));

 PEM_read_bio_PrivateKey(buf, &d->pkey, NULL, "");

 BIO_free(buf);

+ updateFingerprint_TlsCertificate_(d);

 return d;

}



@@ -500,6 +534,7 @@ iTlsCertificate *newSelfSignedRSA_TlsCertificate(

 }

 X509_sign(d->cert, d->pkey, EVP_sha256());

 checkErrors_();

+ updateFingerprint_TlsCertificate_(d);

 return d;

}



@@ -515,6 +550,7 @@ iTlsCertificate *copy_TlsCertificate(const iTlsCertificate *d) {

     copy->pkey = d->pkey;

 }

 *copy->cachedVerifyStatus = *d->cachedVerifyStatus;

+ memcpy(copy->fingerprint, d->fingerprint, sizeof(d->fingerprint));

 return copy;

}



@@ -707,24 +743,8 @@ iBool equal_TlsCertificate(const iTlsCertificate *d, const iTlsCertificate *othe

 return X509_cmp(d->cert, other->cert) == 0;

}



-static void calcSHA256_(BIO *src, iBlock *dst) {

- iBlock der;

- init_Block(&der, 0);

- readAllFromBIO_(src, &der);

- SHA256(constData_Block(&der), size_Block(&der), data_Block(dst));

- deinit_Block(&der);

-}

-

iBlock *fingerprint_TlsCertificate(const iTlsCertificate *d) {

- iBlock *sha = new_Block(SHA256_DIGEST_LENGTH);

- if (d->cert) {

- /* Get the DER serialization of the certificate. */

- BIO *buf = BIO_new(BIO_s_mem());

- i2d_X509_bio(buf, d->cert);

- calcSHA256_(buf, sha);

- BIO_free(buf);

- }

- return sha;

+ return newData_Block(d->fingerprint, sizeof(d->fingerprint));

}



iBlock *publicKeyFingerprint_TlsCertificate(const iTlsCertificate *d) {

@@ -737,7 +757,7 @@ iBlock *publicKeyFingerprint_TlsCertificate(const iTlsCertificate *d) {

     /* Get the DER serialization of the public key. */

     BIO *buf = BIO_new(BIO_s_mem());

     i2d_PUBKEY_bio(buf, pub);

- calcSHA256_(buf, sha);

+ calcSHA256_(buf, data_Block(sha));

     BIO_free(buf);

     EVP_PKEY_free(pub);

 }

@@ -750,7 +770,7 @@ iBlock *privateKeyFingerprint_TlsCertificate(const iTlsCertificate *d) {

     /* Get the DER serialization of the private key. */

     BIO *buf = BIO_new(BIO_s_mem());

     i2d_PrivateKey_bio(buf, d->pkey);

- calcSHA256_(buf, sha);

+ calcSHA256_(buf, data_Block(sha));

     BIO_free(buf);

 }

 return sha;

@@ -960,6 +980,7 @@ void deinit_TlsRequest(iTlsRequest *d) {

     join_Thread(d->thread);

     iRelease(d->thread);

 }

+ iRelease(d->socket);

 deinit_Block(&d->sending);

 SSL_free(d->ssl);

 deinit_Condition(&d->requestDone);

@@ -973,7 +994,6 @@ void deinit_TlsRequest(iTlsRequest *d) {

 delete_TlsCertificate(d->cert);

 iRelease(d->result);

 deinit_Block(&d->content);

- iRelease(d->socket);

 delete_String(d->hostName);

 deinit_Mutex(&d->mtx);

}

@@ -1092,7 +1112,9 @@ static iThreadResult run_TlsRequest_(iThread *thread) {

 iTlsRequest *d = userData_Thread(thread);

 /* Thread-local pointer to the current request so it can be accessed in the

    verify callback. */

- iDebug("[TlsRequest] run_TlsRequest_: %zu bytes to send\n", size_Block(&d->sending));

+ const char *tname = cstr_String(name_Thread(thread));

+ iUnused(tname); /* just for debug logs */

+ iDebug("[%s] run_TlsRequest_: %zu bytes to send\n", tname, size_Block(&d->sending));

 setCurrentRequestForThread_Context_(context_, d);

 doHandshake_TlsRequest_(d);

 for (;;) {

@@ -1109,31 +1131,36 @@ static iThreadResult run_TlsRequest_(iThread *thread) {

             unlock_Mutex(&d->incomingMtx);

         }

         else {

- //fprintf(stderr, "[TlsRequest] run loop exiting, status %d\n", d->status);

+ iDebug("[%s] run loop exiting, status %d\n", tname, d->status);

             unlock_Mutex(&d->mtx);

             break;

         }

     }

 }

- if (!SSL_session_reused(d->ssl) && d->status != error_TlsRequestStatus) {

+ if (d->status != error_TlsRequestStatus && !SSL_session_reused(d->ssl)) {

+ iDebug("[%s] saving session\n", tname);

     saveSession_Context_(

         context_, d->hostName, d->port, SSL_get0_session(d->ssl), d->cert, d->clientCert);

+ iDebug("[%s] saving session succeeded\n", tname);

 }

 readIncoming_TlsRequest_(d);

 iNotifyAudience(d, finished, TlsRequestFinished);

- iDebug("[TlsRequest] finished\n");

+ iDebug("[%s] finished\n", tname);

 return 0;

}



static void connected_TlsRequest_(iTlsRequest *d, iSocket *sock) {

 /* The socket has been connected. During this notification the socket remains locked

    so we must start a different thread for carrying out the I/O. */

+ iBeginCollect();

 iUnused(sock);

 iAssert(!d->thread);

 d->thread = new_Thread(run_TlsRequest_);

- setName_Thread(d->thread, "TlsRequest");

+ static iAtomicInt idGen_ = 1;

+ setName_Thread(d->thread, format_CStr("TlsRequest-%d", add_Atomic(&idGen_, 1)));

 setUserData_Thread(d->thread, d);

 start_Thread(d->thread);

+ iEndCollect();

}



static void disconnected_TlsRequest_(iTlsRequest *d, iSocket *sock) {