diff --git a/component.mk b/component.mk
index 8baf3d6d..560c9d39 100644
--- a/component.mk
+++ b/component.mk
@@ -6,20 +6,12 @@ COMPONENT_OWNBUILDTARGET:= 1
 CROSS_PATH1:=$(shell which xtensa-esp32-elf-gcc )
 CROSS_PATH:= $(shell dirname $(CROSS_PATH1) )/..
 
-#-DLWS_WITH_BORINGSSL=1 \
-#		-DOPENSSL_ROOT_DIR="${PWD}/../../boringssl" \
-#		-DOPENSSL_LIBRARIES="${PWD}/../../boringssl/build/ssl/libssl.a;${PWD}/../../boringssl/build/crypto/libcrypto.a" \
-#		-DOPENSSL_INCLUDE_DIRS="${PWD}/../../boringssl/include" \
-
-# -DNDEBUG=1 after cflags
-#		-DOPENSSL_LIBRARIES=x \
-#		-DCOMPONENT_PATH=$(COMPONENT_PATH) \
-
+# -DNDEBUG=1 after cflags stops debug etc being built
 .PHONY: build
 build:
 	cd $(COMPONENT_BUILD_DIR) ; \
 	echo "doing lws cmake" ; \
-	cmake $(COMPONENT_PATH)  -DLWS_C_FLAGS="$(CFLAGS) " \
+	cmake $(COMPONENT_PATH)  -DLWS_C_FLAGS="$(CFLAGS) -DNDEBUG=1" \
 		-DIDF_PATH=$(IDF_PATH) \
 		-DCROSS_PATH=$(CROSS_PATH) \
 		-DBUILD_DIR_BASE=$(BUILD_DIR_BASE) \
diff --git a/lib/handshake.c b/lib/handshake.c
index d9bbfd2e..04a421d9 100644
--- a/lib/handshake.c
+++ b/lib/handshake.c
@@ -120,8 +120,6 @@ lws_read(struct lws *wsi, unsigned char *buf, lws_filepos_t len)
 		}
 		lwsl_parser("issuing %d bytes to parser\n", (int)len);
 
-		lwsl_hexdump(buf, (size_t)len);
-
 		if (lws_handshake_client(wsi, &buf, (size_t)len))
 			goto bail;
 
diff --git a/lib/header.c b/lib/header.c
index 1e6b2596..6a4cbeed 100644
--- a/lib/header.c
+++ b/lib/header.c
@@ -20,11 +20,11 @@
  */
 
 #include "private-libwebsockets.h"
-
 #include "lextable-strings.h"
 
 
-const unsigned char *lws_token_to_string(enum lws_token_indexes token)
+const unsigned char *
+lws_token_to_string(enum lws_token_indexes token)
 {
 	if ((unsigned int)token >= ARRAY_SIZE(set))
 		return NULL;
@@ -93,6 +93,7 @@ lws_add_http_header_by_token(struct lws *wsi, enum lws_token_indexes token,
 	name = lws_token_to_string(token);
 	if (!name)
 		return 1;
+
 	return lws_add_http_header_by_name(wsi, name, value, length, p, end);
 }
 
@@ -110,6 +111,9 @@ int lws_add_http_header_content_length(struct lws *wsi,
 	wsi->u.http.tx_content_length = content_length;
 	wsi->u.http.tx_content_remain = content_length;
 
+	lwsl_info("%s: wsi %p: tx_content_length/remain %llu\n", __func__,
+			wsi, (unsigned long long)content_length);
+
 	return 0;
 }
 
@@ -171,10 +175,8 @@ lws_add_http_header_status(struct lws *wsi, unsigned int _code,
 
 	if (code == 100)
 		description = "Continue";
-
 	if (code == 200)
 		description = "OK";
-
 	if (code == 304)
 		description = "Not Modified";
 	else
@@ -246,8 +248,7 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 	n = sprintf(slen, "%d", len);
 
 	if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_CONTENT_LENGTH,
-					 (unsigned char *)slen, n,
-					 &p, end))
+					 (unsigned char *)slen, n, &p, end))
 		return 1;
 
 	if (lws_finalize_http_header(wsi, &p, end))
@@ -306,14 +307,11 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 				  code, html_body);
 
 		n = lws_ptr_diff(p, start);
-
 		m = lws_write(wsi, start, n, LWS_WRITE_HTTP);
 		if (m != n)
 			return 1;
 	}
 
-	lwsl_notice("%s: return\n", __func__);
-
 	return m != n;
 }
 
@@ -322,35 +320,29 @@ lws_http_redirect(struct lws *wsi, int code, const unsigned char *loc, int len,
 		  unsigned char **p, unsigned char *end)
 {
 	unsigned char *start = *p;
-	int n;
 
 	if (lws_add_http_header_status(wsi, code, p, end))
 		return -1;
 
-	if (lws_add_http_header_by_token(wsi,
-			WSI_TOKEN_HTTP_LOCATION,
-			loc, len, p, end))
+	if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_LOCATION, loc, len,
+					 p, end))
 		return -1;
 	/*
 	 * if we're going with http/1.1 and keepalive, we have to give fake
 	 * content metadata so the client knows we completed the transaction and
 	 * it can do the redirect...
 	 */
-	if (lws_add_http_header_by_token(wsi,
-			WSI_TOKEN_HTTP_CONTENT_TYPE,
-			(unsigned char *)"text/html", 9,
-			p, end))
+	if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_CONTENT_TYPE,
+					 (unsigned char *)"text/html", 9, p,
+					 end))
 		return -1;
-	if (lws_add_http_header_by_token(wsi,
-			WSI_TOKEN_HTTP_CONTENT_LENGTH,
-			(unsigned char *)"0", 1, p, end))
+	if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_CONTENT_LENGTH,
+					 (unsigned char *)"0", 1, p, end))
 		return -1;
 
 	if (lws_finalize_http_header(wsi, p, end))
 		return -1;
 
-	n = lws_write(wsi, start, *p - start, LWS_WRITE_HTTP_HEADERS |
-					      LWS_WRITE_H2_STREAM_END);
-
-	return n;
+	return lws_write(wsi, start, *p - start, LWS_WRITE_HTTP_HEADERS |
+						 LWS_WRITE_H2_STREAM_END);
 }
diff --git a/lib/plat/lws-plat-esp32.c b/lib/plat/lws-plat-esp32.c
index 210368f8..b9b2c63b 100644
--- a/lib/plat/lws-plat-esp32.c
+++ b/lib/plat/lws-plat-esp32.c
@@ -24,6 +24,12 @@
 #include <esp_attr.h>
 #include <esp_system.h>
 
+int
+lws_plat_socket_offset(void)
+{
+	return LWIP_SOCKET_OFFSET;
+}
+
 /*
  * included from libwebsockets.c for unix builds
  */
@@ -92,16 +98,6 @@ lws_poll_listen_fd(struct lws_pollfd *fd)
 	return select(fd->fd + 1, &readfds, NULL, NULL, &tv);
 }
 
-LWS_VISIBLE void
-lws_cancel_service_pt(struct lws *wsi)
-{
-}
-
-LWS_VISIBLE void
-lws_cancel_service(struct lws_context *context)
-{
-}
-
 LWS_VISIBLE void lwsl_emit_syslog(int level, const char *line)
 {
 	printf("%d: %s", level, line);
@@ -611,7 +607,7 @@ LWS_VISIBLE void esp32_uvtimer_cb(TimerHandle_t t)
 
 /* helper functionality */
 
-#include "romfs.h"
+#include "misc/romfs.h"
 #include <esp_ota_ops.h>
 #include <tcpip_adapter.h>
 #include <esp_image_format.h>
@@ -622,7 +618,6 @@ LWS_VISIBLE void esp32_uvtimer_cb(TimerHandle_t t)
 struct lws_esp32 lws_esp32 = {
 	.model = CONFIG_LWS_MODEL_NAME,
 	.serial = "unknown",
-	.region = WIFI_COUNTRY_US, // default to safest option
 };
 
 /*
@@ -1355,7 +1350,7 @@ int
 lws_esp32_wlan_nvs_get(int retry)
 {
 	nvs_handle nvh;
-	char r[2], lws_esp32_force_ap = 0, slot[12];
+	char lws_esp32_force_ap = 0, slot[12];
 	size_t s;
 	uint8_t mac[6];
 	int n;
@@ -1393,11 +1388,6 @@ lws_esp32_wlan_nvs_get(int retry)
 	if (nvs_get_str(nvh, "opts", lws_esp32.opts, &s) != ESP_OK)
 		lws_esp32_force_ap = 1;
 
-	s = sizeof(r);
-	if (nvs_get_str(nvh, "region", r, &s) != ESP_OK)
-		lws_esp32_force_ap = 1;
-	else
-		lws_esp32.region = atoi(r);
 	lws_esp32.access_pw[0] = '\0';
 	nvs_get_str(nvh, "access_pw", lws_esp32.access_pw, &s);
 
@@ -1488,7 +1478,6 @@ lws_esp32_wlan_start_ap(void)
 
 	ESP_ERROR_CHECK( esp_wifi_init(&cfg));
 	ESP_ERROR_CHECK( esp_wifi_set_storage(WIFI_STORAGE_RAM));
-	esp_wifi_set_country(lws_esp32.region);
 
 	ESP_ERROR_CHECK( esp_wifi_set_mode(WIFI_MODE_APSTA) );
 	ESP_ERROR_CHECK( esp_wifi_set_config(WIFI_IF_AP, &config) );
@@ -1513,7 +1502,6 @@ lws_esp32_wlan_start_station(void)
 
 	ESP_ERROR_CHECK( esp_wifi_init(&cfg));
 	ESP_ERROR_CHECK( esp_wifi_set_storage(WIFI_STORAGE_RAM));
-	esp_wifi_set_country(lws_esp32.region);
 
 	ESP_ERROR_CHECK( esp_wifi_set_mode(WIFI_MODE_STA));
 	ESP_ERROR_CHECK( esp_wifi_set_config(WIFI_IF_STA, &sta_config));
diff --git a/lib/plat/lws-plat-esp8266.c b/lib/plat/lws-plat-esp8266.c
index 7a1e3b34..39e11551 100644
--- a/lib/plat/lws-plat-esp8266.c
+++ b/lib/plat/lws-plat-esp8266.c
@@ -6,6 +6,12 @@
 static struct lws_context *hacky_context;
 static unsigned int time_high, ot;
 
+int
+lws_plat_socket_offset(void)
+{
+	return 0;
+}
+
 /*
  * included from libwebsockets.c for esp8266 builds
  */
diff --git a/lib/plat/lws-plat-optee.c b/lib/plat/lws-plat-optee.c
index 524046b5..1bf72577 100644
--- a/lib/plat/lws-plat-optee.c
+++ b/lib/plat/lws-plat-optee.c
@@ -4,6 +4,12 @@
  * included from libwebsockets.c for OPTEE builds
  */
 
+int
+lws_plat_socket_offset(void)
+{
+	return 0;
+}
+
 int
 lws_plat_pipe_create(struct lws *wsi)
 {
diff --git a/lib/plat/lws-plat-unix.c b/lib/plat/lws-plat-unix.c
index d64afa0e..dd7ba972 100644
--- a/lib/plat/lws-plat-unix.c
+++ b/lib/plat/lws-plat-unix.c
@@ -29,6 +29,12 @@
 #endif
 #include <dirent.h>
 
+int
+lws_plat_socket_offset(void)
+{
+	return 0;
+}
+
 int
 lws_plat_pipe_create(struct lws *wsi)
 {
diff --git a/lib/plat/lws-plat-win.c b/lib/plat/lws-plat-win.c
index b140c6ee..c5c0afc8 100644
--- a/lib/plat/lws-plat-win.c
+++ b/lib/plat/lws-plat-win.c
@@ -3,6 +3,12 @@
 #endif
 #include "private-libwebsockets.h"
 
+int
+lws_plat_socket_offset(void)
+{
+	return 0;
+}
+
 int
 lws_plat_pipe_create(struct lws *wsi)
 {
diff --git a/lib/pollfd.c b/lib/pollfd.c
index 6503f866..4c20a55c 100644
--- a/lib/pollfd.c
+++ b/lib/pollfd.c
@@ -237,9 +237,9 @@ insert_wsi_socket_into_fds(struct lws_context *context, struct lws *wsi)
 	}
 
 #if !defined(_WIN32) && !defined(LWS_WITH_ESP8266)
-	if (wsi->desc.sockfd >= context->max_fds) {
-		lwsl_err("Socket fd %d is too high (%d)\n",
-			 wsi->desc.sockfd, context->max_fds);
+	if (wsi->desc.sockfd - lws_plat_socket_offset() >= context->max_fds) {
+		lwsl_err("Socket fd %d is too high (%d) offset %d\n",
+			 wsi->desc.sockfd, context->max_fds, lws_plat_socket_offset());
 		return 1;
 	}
 #endif
@@ -309,7 +309,7 @@ remove_wsi_socket_from_fds(struct lws *wsi)
 	}
 
 #if !defined(_WIN32) && !defined(LWS_WITH_ESP8266)
-	if (wsi->desc.sockfd > context->max_fds) {
+	if (wsi->desc.sockfd - lws_plat_socket_offset() > context->max_fds) {
 		lwsl_err("fd %d too high (%d)\n", wsi->desc.sockfd,
 			 context->max_fds);
 		return 1;
diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h
index 20bc0134..0876bce0 100644
--- a/lib/private-libwebsockets.h
+++ b/lib/private-libwebsockets.h
@@ -288,6 +288,11 @@ lws_plat_get_peer_simple(struct lws *wsi, char *name, int namelen);
 #else
 #if defined(LWS_WITH_ESP32)
 #define OPENSSL_NO_TLSEXT
+#undef MBEDTLS_CONFIG_FILE
+#define MBEDTLS_CONFIG_FILE <mbedtls/esp_config.h>
+#include <mbedtls/ssl.h>
+#include <mbedtls/x509_crt.h>
+#include "tls/mbedtls/wrapper/include/openssl/ssl.h" /* wrapper !!!! */
 #else
 #if defined(LWS_WITH_MBEDTLS)
 #include <mbedtls/ssl.h>
@@ -2160,9 +2165,9 @@ insert_wsi(struct lws_context *context, struct lws *wsi);
 LWS_EXTERN int
 delete_from_fd(struct lws_context *context, lws_sockfd_type fd);
 #else
-#define wsi_from_fd(A,B)  A->lws_lookup[B]
-#define insert_wsi(A,B)   assert(A->lws_lookup[B->desc.sockfd] == 0); A->lws_lookup[B->desc.sockfd]=B
-#define delete_from_fd(A,B) A->lws_lookup[B]=0
+#define wsi_from_fd(A,B)  A->lws_lookup[B - lws_plat_socket_offset()]
+#define insert_wsi(A,B)   assert(A->lws_lookup[B->desc.sockfd - lws_plat_socket_offset()] == 0); A->lws_lookup[B->desc.sockfd - lws_plat_socket_offset()]=B
+#define delete_from_fd(A,B) A->lws_lookup[B - lws_plat_socket_offset()]=0
 #endif
 
 LWS_EXTERN int LWS_WARN_UNUSED_RESULT
@@ -2297,6 +2302,9 @@ LWS_EXTERN const struct http2_settings lws_h2_defaults;
 #define lws_h2_configure_if_upgraded(x)
 #endif
 
+LWS_EXTERN int
+lws_plat_socket_offset(void);
+
 LWS_EXTERN int
 lws_plat_set_socket_options(struct lws_vhost *vhost, lws_sockfd_type fd);
 
diff --git a/lib/server/server.c b/lib/server/server.c
index 997a6008..44f43c8c 100644
--- a/lib/server/server.c
+++ b/lib/server/server.c
@@ -1352,8 +1352,6 @@ lws_handshake_server(struct lws *wsi, unsigned char **buf, size_t len)
 		assert(0);
 	}
 
-	lwsl_hexdump(*buf, len);
-
 	while (len--) {
 		wsi->more_rx_waiting = !!len;
 
diff --git a/plugins/protocol_esp32_lws_scan.c b/plugins/protocol_esp32_lws_scan.c
index da82dc6b..019172c9 100644
--- a/plugins/protocol_esp32_lws_scan.c
+++ b/plugins/protocol_esp32_lws_scan.c
@@ -574,7 +574,6 @@ scan_state_final:
 		}
 issue:
 //		lwsl_notice("issue: %d (%d)\n", p - start, n);
-		lwsl_hexdump(start, p - start);
 		m = lws_write(wsi, (unsigned char *)start, p - start, n);
 		if (m < 0) {
 			lwsl_err("ERROR %d writing to di socket\n", m);
diff --git a/plugins/ssh-base/sshd.c b/plugins/ssh-base/sshd.c
index c121178f..97e52453 100644
--- a/plugins/ssh-base/sshd.c
+++ b/plugins/ssh-base/sshd.c
@@ -2077,6 +2077,8 @@ lws_callback_raw_sshd(struct lws *wsi, enum lws_callback_reasons reason,
 		break;
 
 	case LWS_CALLBACK_RAW_WRITEABLE:
+		if (!pss)
+			break;
 		n = 0;
 		o = pss->write_task[pss->wt_tail];
 		ch = pss->write_channel[pss->wt_tail];
@@ -2455,6 +2457,8 @@ bail:
 		break;
 
 	case LWS_CALLBACK_CGI:
+		if (!pss)
+			break;
 		if (pss->vhd && pss->vhd->ops &&
 		    pss->vhd->ops->child_process_io &&
 		    pss->vhd->ops->child_process_io(pss->ch_temp->priv,
@@ -2463,6 +2467,8 @@ bail:
 		break;
 
 	case LWS_CALLBACK_CGI_PROCESS_ATTACH:
+		if (!pss)
+			break;
 		ch = ssh_get_server_ch(pss, pss->channel_doing_spawn);
 		if (ch) {
 			ch->spawn_pid = (int)len; /* child process PID */