@@ -37,10 +37,11 @@
 #import <ObjOpenSSL/X509Certificate.h>
 
 #import "XMPPConnection.h"
 #import "XMPPCallback.h"
 #import "XMPPSRVLookup.h"
+#import "XMPPEXTERNALAuth.h"
 #import "XMPPSCRAMAuth.h"
 #import "XMPPPLAINAuth.h"
 #import "XMPPStanza.h"
 #import "XMPPJID.h"
 #import "XMPPIQ.h"
@@ -80,10 +81,12 @@
 	[sock release];
 	[parser release];
 	[elementBuilder release];
 	[username release];
 	[password release];
+	[privateKeyFile release];
+	[certificateFile release];
 	[server release];
 	[domain release];
 	[resource release];
 	[JID release];
 	[callbacks release];
@@ -217,10 +220,30 @@
 
 - (OFString*)password
 {
 	return [[password copy] autorelease];
 }
+
+- (void)setPrivateKeyFile: (OFString*)file
+{
+	OF_SETTER(privateKeyFile, file, YES, YES)
+}
+
+- (OFString*)privateKeyFile
+{
+	OF_GETTER(privateKeyFile, YES)
+}
+
+- (void)setCertificateFile: (OFString*)file
+{
+	OF_SETTER(certificateFile, file, YES, YES)
+}
+
+- (OFString*)certificateFile
+{
+	OF_GETTER(certificateFile, YES)
+}
 
 - (void)connect
 {
 	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
 	XMPPSRVEntry *candidate = nil;
@@ -671,11 +694,13 @@
 
 		if ([delegate respondsToSelector:
 		    @selector(connectionWillUpgradeToTLS:)])
 			[delegate connectionWillUpgradeToTLS: self];
 
-		newSock = [[SSLSocket alloc] initWithSocket: sock];
+		newSock = [[SSLSocket alloc] initWithSocket: sock
+					     privateKeyFile: privateKeyFile
+					    certificateFile: certificateFile];
 		[sock release];
 		sock = newSock;
 
 		encrypted = YES;
 
@@ -816,10 +841,17 @@
 		OFXMLElement *mech;
 
 		enumerator = [[mechs children] objectEnumerator];
 		while ((mech = [enumerator nextObject]) != nil)
 			[mechanisms addObject: [mech stringValue]];
+
+		if (privateKeyFile && certificateFile &&
+		    [mechanisms containsObject: @"EXTERNAL"]) {
+			authModule = [[XMPPEXTERNALAuth alloc] init];
+			[self XMPP_sendAuth: @"EXTERNAL"];
+			return;
+		}
 
 		if ([mechanisms containsObject: @"SCRAM-SHA-1-PLUS"]) {
 			authModule = [[XMPPSCRAMAuth alloc]
 			    initWithAuthcid: username
 				   password: password