diff --git a/testssl.sh b/testssl.sh
index a487812..4f0ab91 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -4187,7 +4187,11 @@ certificate_info() {
      out "$indent" ; pr_bold " Signature Algorithm          "
      case $cert_sig_algo in
           sha1WithRSAEncryption)
-               pr_svrty_mediumln "SHA1 with RSA"
+               pr_svrty_medium "SHA1 with RSA"
+               if [[ "$SERVICE" == HTTP ]]; then
+                    out " -- besides: users will receive a strong browser warning"
+               fi
+               outln
                fileout "${json_prefix}algorithm" "MEDIUM" "Signature Algorithm: SHA1 with RSA (warning)"
                ;;
           sha224WithRSAEncryption)
@@ -6008,8 +6012,12 @@ tls_sockets() {
 
 # mainly adapted from https://gist.github.com/takeshixx/10107280
 run_heartbleed(){
-     local tls_proto_offered tls_hexcode heartbleed_payload client_hello
-     local -i retval ret lines_returned bytes_returned
+     local tls_proto_offered tls_hexcode
+     local heartbleed_payload client_hello 
+     local -i n ret lines_returned
+     local -i hb_rounds=3
+     local append=""
+     local found_500_oops=false
 
      [[ $VULN_COUNT -le $VULN_THRESHLD ]] && outln && pr_headlineln " Testing for heartbleed vulnerability " && outln
      pr_bold " Heartbleed"; out " (CVE-2014-0160)                "
@@ -6017,8 +6025,8 @@ run_heartbleed(){
      [[ -z "$TLS_EXTENSIONS" ]] && determine_tls_extensions
      if ! grep -q heartbeat <<< "$TLS_EXTENSIONS"; then
           pr_done_best "not vulnerable (OK)"
-          outln " (no heartbeat extension)"
-          fileout "heartbleed" "OK" "Heartbleed (CVE-2014-0160): not vulnerable (OK) (no heartbeat extension)"
+          outln ", no heartbeat extension"
+          fileout "heartbleed" "OK" "Heartbleed (CVE-2014-0160): not vulnerable (OK), no heartbeat extension"
           return 0
      fi
 
@@ -6086,56 +6094,82 @@ run_heartbleed(){
      # extension: heartbeat
      x00, x0f, x00, x01, x01"
 
-     fd_socket 5 || return 6
+     for (( n=1; n <= hb_rounds; n++)); do
+          fd_socket 5 || return 6
+          debugme out "\nsending client hello (TLS version $tls_hexcode)"
+          debugme outln " ($n of $hb_rounds)"
+          socksend "$client_hello" 1
 
-     debugme outln "\nsending client hello (TLS version $tls_hexcode)"
-     socksend "$client_hello" 1
-
-     debugme outln "\nreading server hello"
-     sockread_serverhello 32768
-     if [[ $DEBUG -ge 4 ]]; then
-          hexdump -C "$SOCK_REPLY_FILE" | head -20
-          outln "[...]"
-          outln "\nsending payload with TLS version $tls_hexcode:"
-     fi
-     rm "$SOCK_REPLY_FILE"
-
-     socksend "$heartbleed_payload" 1
-     sockread_serverhello 16384 $HEARTBLEED_MAX_WAITSOCK
-     retval=$?
-
-     if [[ $DEBUG -ge 3 ]]; then
-          outln "\nheartbleed reply: "
-          hexdump -C "$SOCK_REPLY_FILE" | head -20
-          bytes_returned="$(wc -c "$SOCK_REPLY_FILE" | awk '{ print $1 }')"
-          [[ $bytes_returned -gt 320 ]] && outln "[...]"
-          outln
-     fi
-
-     lines_returned=$(hexdump -ve '16/1 "%02x " " \n"' "$SOCK_REPLY_FILE" | wc -l | sed 's/ //g')
-     rm "$SOCK_REPLY_FILE"
-     if [[ $lines_returned -gt 1 ]]; then
-          pr_svrty_critical "VULNERABLE (NOT ok)"
-          if [[ $retval -eq 3 ]]; then
-               fileout "heartbleed" "NOT ok" "Heartbleed (CVE-2014-0160): VULNERABLE (NOT ok) (timed out)"
-          else
-               fileout "heartbleed" "NOT ok" "Heartbleed (CVE-2014-0160): VULNERABLE (NOT ok)"
+          debugme outln "\nreading server hello"
+          sockread_serverhello 32768
+          if [[ $DEBUG -ge 4 ]]; then
+               hexdump -C "$SOCK_REPLY_FILE" | head -20
+               outln "[...]"
+               outln "\nsending payload with TLS version $tls_hexcode:"
+          fi
+          rm "$SOCK_REPLY_FILE"
+
+          socksend "$heartbleed_payload" 1
+          sockread_serverhello 16384 $HEARTBLEED_MAX_WAITSOCK
+          [[ $? -eq 3 ]] && append=", timed out"
+
+          lines_returned=$(hexdump -ve '16/1 "%02x " " \n"' "$SOCK_REPLY_FILE" | wc -l | sed 's/ //g')
+          if [[ $DEBUG -ge 3 ]]; then
+               outln "\nheartbleed reply: "
+               hexdump -C "$SOCK_REPLY_FILE" | head -20
+               [[ $lines_returned -gt 20 ]] && outln "[...]"
+               outln
+          fi
+
+          if [[ $lines_returned -gt 1 ]]; then
+               if [[ "$STARTTLS_PROTOCOL" == "ftp" ]] || [[ "$STARTTLS_PROTOCOL" == "ftps" ]]; then
+                    # check possibility of weird vsftpd reply, see #426
+                    saved_sockreply[n]="$(hexdump -ve '1/1 "%.2x"' "$SOCK_REPLY_FILE")"
+                    [[ $n -eq 1 ]] && grep -q '500 OOPS' "$SOCK_REPLY_FILE" && found_500_oops=true
+                    rm "$SOCK_REPLY_FILE"
+                    #debugme out "${saved_sockreply[n]}"
+                    #TMPFILE="${saved_sockreply[n]}"
+                    close_socket
+                    #tmpfile_handle "$FUNCNAME,$n.txt"
+               else
+                    rm "$SOCK_REPLY_FILE"
+                    pr_svrty_critical "VULNERABLE (NOT ok)"
+                    fileout "heartbleed" "NOT ok" "Heartbleed (CVE-2014-0160): VULNERABLE (NOT ok)$append"
+                    ret=1
+                    break
+               fi
+          else
+               rm "$SOCK_REPLY_FILE"
+               pr_done_best "not vulnerable (OK)"
+               fileout "heartbleed" "OK" "Heartbleed (CVE-2014-0160): not vulnerable (OK)$append"
+               ret=0
+               break
+          fi
+     done
+
+     if [[ $n -gt 1 ]]; then
+          # more than one round of heartbleed checks --> vsftpd probably.
+          # This is the robust approach. According to a few tests it could also suffice # to check for "500 OOPS" only.
+          # Checking for the same socket reply DOES NOT suffice -- server can be idle and return the same memory
+          if [[ "${saved_sockreply[1]}" == "${saved_sockreply[2]}" ]] && [[ "${saved_sockreply[2]}" == "${saved_sockreply[3]}" ]] \
+               && "$found_500_oops"; then
+               pr_done_best "not vulnerable (OK)$append"
+               [[ $DEBUG -ge 1 ]] && out ", successful weeded out vsftpd false positive"
+               fileout "heartbleed" "OK" "Heartbleed (CVE-2014-0160): not vulnerable (OK)$append"
+          else
+               out "likely "
+               pr_svrty_critical "VULNERABLE (NOT ok)"
+               [[ $DEBUG -ge 1 ]] && out " use debug >=2 to confirm"
+               fileout "heartbleed" "NOT ok" "Heartbleed (CVE-2014-0160): likely VULNERABLE (NOT ok)$append"
           fi
-          ret=1
      else
-          pr_done_best "not vulnerable (OK)"
-          if [[ $retval -eq 3 ]]; then
-               fileout "heartbleed" "OK" "Heartbleed (CVE-2014-0160): not vulnerable (OK) (timed out)"
-          else
-               fileout "heartbleed" "OK" "Heartbleed (CVE-2014-0160): not vulnerable (OK)"
-          fi
-          ret=0
+          # for the repeated tries we did that already
+          #TMPFILE="$SOCKREPLY"
+          close_socket 2>/dev/null
+          #tmpfile_handle $FUNCNAME.txt
      fi
-     [[ $retval -eq 3 ]] && out " (timed out)"
-     outln
+     outln "$append"
 
-     close_socket
-     tmpfile_handle $FUNCNAME.txt
      return $ret
 }
 
@@ -8751,4 +8785,4 @@ fi
 exit $?
 
 
-#  $Id: testssl.sh,v 1.537 2016/09/01 17:09:11 dirkw Exp $
+#  $Id: testssl.sh,v 1.540 2016/09/06 06:32:04 dirkw Exp $