Index: tests/keytest1.tcl
==================================================================
--- tests/keytest1.tcl
+++ tests/keytest1.tcl
@@ -1,24 +1,25 @@
-#!/bin/sh
-# The next line is executed by /bin/sh, but not tcl \
-exec tclsh "$0" ${1+"$@"}
+#!/usr/bin/env tclsh
 
 set auto_path [linsert $auto_path 0 [file normalize [file join [file dirname [info script]] ..]]]
 package require tls
 
 proc creadable {s} {
     puts "LINE=[gets $s]"
     after 2000
+    file delete -force $::keyfile
+    file delete -force $::certfile
     exit
 }
 
 proc myserv {s args} {
     fileevent $s readable [list creadable $s]
 }
 
-close [file tempfile keyfile]
-close [file tempfile certfile]
+close [file tempfile keyfile keyfile]
+close [file tempfile certfile certfile]
+
 tls::misc req 1024 $keyfile $certfile [list C CCC ST STTT L LLLL O OOOO OU OUUUU CN CNNNN Email some@email.com days 730 serial 12]
 
 tls::socket -keyfile $keyfile -certfile $certfile -server myserv 12300
 
 puts "Now run keytest2.tcl"

Index: tests/simpleClient.tcl
==================================================================
--- tests/simpleClient.tcl
+++ tests/simpleClient.tcl
@@ -1,8 +1,6 @@
-#!/bin/sh
-# The next line is executed by /bin/sh, but not tcl \
-exec tclsh8.3 "$0" ${1+"$@"}
+#!/usr/bin/env tclsh
 
 package require tls
 
 set dir			[file join [file dirname [info script]] ../tests/certs]
 set OPTS(-cafile)	[file join $dir ca.pem]

Index: tests/simpleServer.tcl
==================================================================
--- tests/simpleServer.tcl
+++ tests/simpleServer.tcl
@@ -1,8 +1,6 @@
-#!/bin/sh
-# The next line is executed by /bin/sh, but not tcl \
-exec tclsh8.3 "$0" ${1+"$@"}
+#!/usr/bin/env tclsh
 
 package require tls
 
 set dir			[file join [file dirname [info script]] ../tests/certs]
 set OPTS(-cafile)	[file join $dir ca.pem]

Index: tls.c
==================================================================
--- tls.c
+++ tls.c
@@ -1603,12 +1603,13 @@
     Tcl_Interp *interp;
     int objc;
     Tcl_Obj	*CONST objv[];
 {
     static CONST84 char *commands [] = { "req", NULL };
-    enum command { C_REQ, C_DUMMY };
-    int cmd;
+    enum command { C_REQ, C_STRREQ, C_DUMMY };
+    int cmd, isStr;
+    char buffer[16384];
 
     dprintf("Called");
 
     if (objc < 2) {
 	Tcl_WrongNumArgs(interp, 1, objv, "subcommand ?args?");
@@ -1617,12 +1618,14 @@
     if (Tcl_GetIndexFromObj(interp, objv[1], commands,
 	    "command", 0,&cmd) != TCL_OK) {
 	return TCL_ERROR;
     }
 
+    isStr = (cmd == C_STRREQ);
     switch ((enum command) cmd) {
-	case C_REQ: {
+	case C_REQ:
+	case C_STRREQ: {
 	    EVP_PKEY *pkey=NULL;
 	    X509 *cert=NULL;
 	    X509_NAME *name=NULL;
 	    Tcl_Obj **listv;
 	    int listc,i;
@@ -1641,10 +1644,14 @@
 	    if (Tcl_GetIntFromObj(interp, objv[2], &keysize) != TCL_OK) {
 		return TCL_ERROR;
 	    }
 	    keyout=Tcl_GetString(objv[3]);
 	    pemout=Tcl_GetString(objv[4]);
+	    if (isStr) {
+		Tcl_SetVar(interp,keyout,"",0);
+		Tcl_SetVar(interp,pemout,"",0);
+	    }
 
 	    if (objc>=6) {
 		if (Tcl_ListObjGetElements(interp, objv[5],
 			&listc, &listv) != TCL_OK) {
 		    return TCL_ERROR;
@@ -1657,13 +1664,10 @@
 		for (i=0; i<listc; i+=2) {
 		    str=Tcl_GetString(listv[i]);
 		    if (strcmp(str,"days")==0) {
 			if (Tcl_GetIntFromObj(interp,listv[i+1],&days)!=TCL_OK)
 			    return TCL_ERROR;
-		    } else if (strcmp(str,"serial")==0) {
-			if (Tcl_GetIntFromObj(interp,listv[i+1],&serial)!=TCL_OK)
-			    return TCL_ERROR;
 		    } else if (strcmp(str,"serial")==0) {
 			if (Tcl_GetIntFromObj(interp,listv[i+1],&serial)!=TCL_OK)
 			    return TCL_ERROR;
 		    } else if (strcmp(str,"C")==0) {
 			k_C=Tcl_GetString(listv[i+1]);
@@ -1690,14 +1694,26 @@
 			RSA_generate_key(keysize, 0x10001, NULL, NULL))) {
 		    Tcl_SetResult(interp,"Error generating private key",NULL);
 		    EVP_PKEY_free(pkey);
 		    return TCL_ERROR;
 		}
-		out=BIO_new(BIO_s_file());
-		BIO_write_filename(out,keyout);
-		PEM_write_bio_PrivateKey(out,pkey,NULL,NULL,0,NULL,NULL);
-		BIO_free_all(out);
+
+		if (isStr) {
+		    out=BIO_new(BIO_s_mem());
+		    PEM_write_bio_PrivateKey(out,pkey,NULL,NULL,0,NULL,NULL);
+		    i=BIO_read(out,buffer,sizeof(buffer)-1);
+		    i=(i<0) ? 0 : i;
+		    buffer[i]='\0';
+		    Tcl_SetVar(interp,keyout,buffer,0);
+		    BIO_flush(out);
+		    BIO_free(out);
+		} else {
+		    out=BIO_new(BIO_s_file());
+		    BIO_write_filename(out,keyout);
+		    PEM_write_bio_PrivateKey(out,pkey,NULL,NULL,0,NULL,NULL);
+		    BIO_free_all(out);
+		}
 
 		if ((cert=X509_new())==NULL) {
 		    Tcl_SetResult(interp,"Error generating certificate request",NULL);
 		    EVP_PKEY_free(pkey);
 		    return(TCL_ERROR);
@@ -1719,22 +1735,32 @@
 		X509_NAME_add_entry_by_txt(name,"CN", MBSTRING_ASC, (const unsigned char *) k_CN, -1, -1, 0);
 		X509_NAME_add_entry_by_txt(name,"Email", MBSTRING_ASC, (const unsigned char *) k_Email, -1, -1, 0);
 
 		X509_set_subject_name(cert,name);
 
-		if (!X509_sign(cert,pkey,EVP_md5())) {
+		if (!X509_sign(cert,pkey,EVP_sha1())) {
 		    X509_free(cert);
 		    EVP_PKEY_free(pkey);
 		    Tcl_SetResult(interp,"Error signing certificate",NULL);
 		    return TCL_ERROR;
 		}
 
-		out=BIO_new(BIO_s_file());
-		BIO_write_filename(out,pemout);
-
-		PEM_write_bio_X509(out,cert);
-		BIO_free_all(out);
+		if (isStr) {
+		    out=BIO_new(BIO_s_mem());
+		    PEM_write_bio_X509(out,cert);
+		    i=BIO_read(out,buffer,sizeof(buffer)-1);
+		    i=(i<0) ? 0 : i;
+		    buffer[i]='\0';
+		    Tcl_SetVar(interp,pemout,buffer,0);
+		    BIO_flush(out);
+		    BIO_free(out);
+		} else {
+		    out=BIO_new(BIO_s_file());
+		    BIO_write_filename(out,pemout);
+		    PEM_write_bio_X509(out,cert);
+		    BIO_free_all(out);
+		}
 
 		X509_free(cert);
 		EVP_PKEY_free(pkey);
 	    } else {
 		Tcl_SetResult(interp,"Error generating private key",NULL);