--- a/auto/modules
+++ b/auto/modules
@@ -58,6 +58,14 @@ if [ $HTTP_GZIP = YES ]; then
     HTTP_SRCS="$HTTP_SRCS $HTTP_GZIP_SRCS"
 fi
 
+if [ $HTTP_SSL = YES ]; then
+    have=NGX_HTTP_SSL . auto/have
+    HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SSL_FILTER_MODULE"
+    HTTP_SRCS="$HTTP_SRCS $HTTP_SSL_SRCS"
+    # STUB: move to auto/libs/ssl
+    CORE_LIBS="$CORE_LIBS -lssl -lcrypto"
+fi
+
 if [ $HTTP_SSI = YES ]; then
     have=NGX_HTTP_SSI . auto/have
     HTTP_FILTER_MODULES="$HTTP_FILTER_MODULES $HTTP_SSI_FILTER_MODULE"

--- a/auto/options
+++ b/auto/options
@@ -31,6 +31,7 @@ USE_THREADS=NO
 
 HTTP_CHARSET=YES
 HTTP_GZIP=YES
+HTTP_SSL=NO
 HTTP_SSI=YES
 HTTP_ACCESS=YES
 HTTP_STATUS=YES
@@ -83,9 +84,10 @@ do
         --with-threads=*)                USE_THREADS="$value"       ;;
         --with-threads)                  USE_THREADS="pthreads"     ;;
 
+        --with-http_ssl_module)          HTTP_SSL=YES               ;;
         --without-http_charset_module)   HTTP_CHARSET=NO            ;;
+        --without-http_gzip_module)      HTTP_GZIP=NO               ;;
         --without-http_ssi_module)       HTTP_SSI=NO                ;;
-        --without-http_gzip_module)      HTTP_GZIP=NO               ;;
         --without-http_access_module)    HTTP_ACCESS=NO             ;;
         --without-http_status_module)    HTTP_STATUS=NO             ;;
         --without-http_rewrite_module)   HTTP_REWRITE=NO            ;;

--- a/auto/sources
+++ b/auto/sources
@@ -249,6 +249,10 @@ HTTP_GZIP_FILTER_MODULE=ngx_http_gzip_fi
 HTTP_GZIP_SRCS=src/http/modules/ngx_http_gzip_filter.c
 
 
+HTTP_SSL_FILTER_MODULE=ngx_http_ssl_filter_module
+HTTP_SSL_SRCS=src/http/modules/ngx_http_ssl_filter.c
+
+
 HTTP_SSI_FILTER_MODULE=ngx_http_ssi_filter_module
 HTTP_SSI_SRCS=src/http/modules/ngx_http_ssi_filter.c
 

--- a/src/core/ngx_conf_file.h
+++ b/src/core/ngx_conf_file.h
@@ -45,6 +45,7 @@
 
 #define NGX_CONF_UNSET       -1
 #define NGX_CONF_UNSET_UINT  (ngx_uint_t) -1
+#define NGX_CONF_UNSET_PTR   (void *) -1
 #define NGX_CONF_UNSET_SIZE  (size_t) -1
 #define NGX_CONF_UNSET_MSEC  (ngx_msec_t) -1
 
@@ -181,7 +182,7 @@ char *ngx_conf_check_num_bounds(ngx_conf
     }
 
 #define ngx_conf_init_ptr_value(conf, default)                               \
-    if (conf == (void *) NGX_CONF_UNSET) {                                   \
+    if (conf == NGX_CONF_UNSET_PTR) {                                        \
         conf = default;                                                      \
     }
 
@@ -205,6 +206,11 @@ char *ngx_conf_check_num_bounds(ngx_conf
         conf = (prev == NGX_CONF_UNSET) ? default : prev;                    \
     }
 
+#define ngx_conf_merge_ptr_value(conf, prev, default)                        \
+    if (conf == NULL) {                                                      \
+        conf = (prev == NULL) ? default : prev;                              \
+    }
+
 #define ngx_conf_merge_unsigned_value(conf, prev, default)                   \
     if (conf == NGX_CONF_UNSET_UINT) {                                       \
         conf = (prev == NGX_CONF_UNSET_UINT) ? default : prev;               \

--- a/src/event/modules/ngx_kqueue_module.c
+++ b/src/event/modules/ngx_kqueue_module.c
@@ -205,7 +205,9 @@ static void ngx_kqueue_done(ngx_cycle_t 
 
     ngx_kqueue = -1;
 
+#if (NGX_THREADS)
     ngx_mutex_destroy(ngx_kqueue_mutex);
+#endif
 
     ngx_free(change_list1);
     ngx_free(change_list0);

new file mode 100644
--- /dev/null
+++ b/src/http/modules/ngx_http_ssl_filter.c
@@ -0,0 +1,248 @@
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_http.h>
+
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+
+
+#define NGX_DEFLAUT_CERTIFICATE      "cert.pem"
+#define NGX_DEFLAUT_CERTIFICATE_KEY  "cert.pem"
+
+
+typedef struct {
+    ngx_flag_t   enable;
+    ngx_str_t    certificate;
+    ngx_str_t    certificate_key;
+} ngx_http_ssl_srv_conf_t;
+
+
+typedef struct {
+    SSL       *ssl;
+    SSL_CTX   *ssl_ctx;
+
+    unsigned   accepted;
+} ngx_http_ssl_ctx_t;
+
+
+static ngx_http_ssl_ctx_t *ngx_http_ssl_create_ctx(ngx_http_request_t *r);
+static void ngx_http_ssl_error(ngx_uint_t level, ngx_log_t *log, int err,
+                               char *fmt, ...);
+static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf);
+static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf,
+                                         void *parent, void *child);
+static ngx_int_t ngx_http_ssl_filter_init(ngx_cycle_t *cycle);
+
+
+static ngx_command_t  ngx_http_charset_filter_commands[] = {
+
+    { ngx_string("ssl_"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_ssl_srv_conf_t, enable),
+      NULL },
+
+    { ngx_string("ssl_certificate"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_str_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_ssl_srv_conf_t, certificate),
+      NULL },
+
+    { ngx_string("ssl_certificate_key"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_str_slot,
+      NGX_HTTP_SRV_CONF_OFFSET,
+      offsetof(ngx_http_ssl_srv_conf_t, certificate_key),
+      NULL },
+
+      ngx_null_command
+};
+
+
+static ngx_http_module_t  ngx_http_ssl_filter_module_ctx = {
+    NULL,                                  /* pre conf */
+
+    NULL,                                  /* create main configuration */
+    NULL,                                  /* init main configuration */
+
+    ngx_http_ssl_create_srv_conf,          /* create server configuration */
+    ngx_http_ssl_merge_srv_conf,           /* merge server configuration */
+
+    NULL,                                  /* create location configuration */
+    NULL,                                  /* merge location configuration */
+};
+
+
+ngx_module_t  ngx_http_ssl_filter_module = {
+    NGX_MODULE,
+    &ngx_http_ssl_filter_module_ctx,       /* module context */
+    NULL,                                  /* module directives */
+    NGX_HTTP_MODULE,                       /* module type */
+    ngx_http_ssl_filter_init,              /* init module */
+    NULL                                   /* init process */
+};
+
+
+ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r)
+{
+    int                  rc;
+    ngx_http_ssl_ctx_t  *ctx;
+
+    ctx = ngx_http_get_module_ctx(r, ngx_http_ssl_filter_module);
+
+    if (ctx == NULL) {
+        ctx = ngx_http_ssl_create_ctx(r);
+
+        if (ctx == NULL) {
+            return NGX_HTTP_INTERNAL_SERVER_ERROR;
+        }
+    }
+
+    if (!ctx->accepted) {
+        rc = SSL_accept(ctx->ssl);
+
+        if (rc != 1) {
+            rc = SSL_get_error(ctx->ssl, rc);
+
+            if (rc == SSL_ERROR_WANT_READ || rc == SSL_ERROR_WANT_WRITE) {
+                return NGX_AGAIN;
+            }
+
+            ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, rc,
+                               "SSL_accept() failed");
+            return NGX_ERROR;
+        }
+
+        ctx->accepted = 1;
+    }
+
+    return NGX_OK;
+}
+
+
+static ngx_http_ssl_ctx_t *ngx_http_ssl_create_ctx(ngx_http_request_t *r)
+{
+    ngx_http_ssl_ctx_t       *ctx;
+    ngx_http_ssl_srv_conf_t  *scf;
+
+    ngx_http_create_ctx(r, ctx, ngx_http_ssl_filter_module,
+                        sizeof(ngx_http_ssl_ctx_t), NULL);
+
+    /* TODO: configure methods */
+    ctx->ssl_ctx = SSL_CTX_new(SSLv23_server_method());
+
+    if (ctx->ssl_ctx == NULL) {
+        ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0,
+                           "SSL_CTX_new() failed");
+        return NULL;
+    }
+
+    scf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_filter_module);
+
+    if (SSL_CTX_use_certificate_file(ctx->ssl_ctx, scf->certificate.data,
+                                     SSL_FILETYPE_PEM) == 0) {
+        ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0,
+                           "SSL_CTX_use_certificate_file() failed");
+        return NULL;
+    }
+
+    if (SSL_CTX_use_PrivateKey_file(ctx->ssl_ctx, scf->certificate_key.data,
+                                    SSL_FILETYPE_PEM) == 0) {
+        ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0,
+                           "SSL_CTX_use_PrivateKey_file() failed");
+        return NULL;
+    }
+
+    ctx->ssl = SSL_new(ctx->ssl_ctx);
+
+    if (ctx->ssl == NULL) {
+        ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0,
+                           "SSL_new() failed");
+        return NULL;
+    }
+
+    if (SSL_set_fd(ctx->ssl, r->connection->fd) == 0) {
+        ngx_http_ssl_error(NGX_LOG_ALERT, r->connection->log, 0,
+                           "SSL_set_fd() failed");
+        return NULL;
+    }
+
+    return ctx;
+}
+
+
+static void ngx_http_ssl_error(ngx_uint_t level, ngx_log_t *log, int err,
+                               char *fmt, ...)
+{
+    int      len;
+    char     errstr[NGX_MAX_CONF_ERRSTR];
+    va_list  args;
+
+    va_start(args, fmt);
+    len = ngx_vsnprintf(errstr, sizeof(errstr) - 1, fmt, args);
+    va_end(args);
+
+    errstr[len++] = ' ';
+    errstr[len++] = '(';
+    errstr[len++] = 'S';
+    errstr[len++] = 'S';
+    errstr[len++] = 'L';
+    errstr[len++] = ':';
+    errstr[len++] = ' ';
+
+    ERR_error_string_n(ERR_get_error(), errstr + len, sizeof(errstr) - len - 1);
+
+    ngx_log_error(level, log, 0, "%s)", errstr);
+}
+
+
+static void *ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
+{
+    ngx_http_ssl_srv_conf_t  *scf;
+
+    if (!(scf = ngx_pcalloc(cf->pool, sizeof(ngx_http_ssl_srv_conf_t)))) {
+        return NGX_CONF_ERROR;
+    }
+
+    scf->enable = NGX_CONF_UNSET;
+
+    return scf;
+}
+
+
+static char *ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf,
+                                         void *parent, void *child)
+{
+    ngx_http_ssl_srv_conf_t *prev = parent;
+    ngx_http_ssl_srv_conf_t *conf = child;
+
+    ngx_conf_merge_value(conf->enable, prev->enable, 0);
+
+    ngx_conf_merge_str_value(conf->certificate, prev->certificate,
+                             NGX_DEFLAUT_CERTIFICATE);
+
+    ngx_conf_merge_str_value(conf->certificate_key, prev->certificate_key,
+                             NGX_DEFLAUT_CERTIFICATE_KEY);
+
+    return NGX_CONF_OK;
+}
+
+
+static ngx_int_t ngx_http_ssl_filter_init(ngx_cycle_t *cycle)
+{
+    SSL_library_init();
+    SSL_load_error_strings();
+
+#if 0
+    ngx_http_next_header_filter = ngx_http_top_header_filter;
+    ngx_http_top_header_filter = ngx_http_ssl_header_filter;
+
+    ngx_http_next_body_filter = ngx_http_top_body_filter;
+    ngx_http_top_body_filter = ngx_http_ssl_body_filter;
+#endif
+
+    return NGX_OK;
+}

new file mode 100644
--- /dev/null
+++ b/src/http/modules/ngx_http_ssl_filter.h
@@ -0,0 +1,13 @@
+#ifndef _NGX_HTTP_SSL_FILTER_H_INCLUDED_
+#define _NGX_HTTP_SSL_FILTER_H_INCLUDED_
+
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_http.h>
+
+
+ngx_int_t ngx_http_ssl_read(ngx_http_request_t *r);
+
+
+#endif /* _NGX_HTTP_SSL_FILTER_H_INCLUDED_ */

--- a/src/http/ngx_http.h
+++ b/src/http/ngx_http.h
@@ -10,7 +10,9 @@ typedef struct ngx_http_request_s  ngx_h
 typedef struct ngx_http_cleanup_s  ngx_http_cleanup_t;
 
 #if (NGX_HTTP_CACHE)
+#include <ngx_http_cache.h>
 #endif
+/* STUB */
 #include <ngx_http_cache.h>
 
 #include <ngx_http_request.h>
@@ -19,6 +21,10 @@ typedef struct ngx_http_cleanup_s  ngx_h
 #include <ngx_http_log_handler.h>
 #include <ngx_http_core_module.h>
 
+#if (NGX_HTTP_SSL)
+#include <ngx_http_ssl_filter.h>
+#endif
+
 
 typedef struct {
     u_int     connection;
@@ -49,14 +55,6 @@ typedef struct {
             r->ctx[module.ctx_index] = NULL;
 
 
-/* STUB */
-#define NGX_INDEX "index.html"
-
-
-/* STUB */
-int ngx_http_init(ngx_pool_t *pool, ngx_log_t *log);
-/**/
-
 void ngx_http_init_connection(ngx_connection_t *c);
 
 ngx_int_t ngx_http_parse_request_line(ngx_http_request_t *r);

--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -815,8 +815,12 @@ static ssize_t ngx_http_read_request_hea
         return NGX_AGAIN;
     }
 
+#if 1
+    ngx_http_ssl_read(r);
+#else
     n = ngx_recv(r->connection, r->header_in->last,
                  r->header_in->end - r->header_in->last);
+#endif
 
     if (n == NGX_AGAIN) {
         if (!r->header_timeout_set) {

--- a/src/os/unix/ngx_thread.h
+++ b/src/os/unix/ngx_thread.h
@@ -107,6 +107,7 @@ ngx_int_t ngx_cond_signal(ngx_cond_t *cv
 #define ngx_log_tid  0
 #define TID_T_FMT    "%d"
 
+#define ngx_mutex_trylock(m)  NGX_OK
 #define ngx_mutex_lock(m)     NGX_OK
 #define ngx_mutex_unlock(m)