diff --git a/CHANGELOG.markdown b/CHANGELOG.markdown
--- a/CHANGELOG.markdown
+++ b/CHANGELOG.markdown
@@ -1,5 +1,12 @@
+* _v0.8.6_  
+	Internal modules are exposed. Mostly so the test suite would only
+	depend on the library and not the code directly, but occasionally
+	someone needed to poke at the internals. Usual warning against
+	doing that applies. They are _not_ visible in the generated Haddock
+	documentation.
+
 * _v0.8.4_  
-	Support GHC 8.
+	Support GHC 8.0
 
 * _v0.8.3_  
 	A pure version of `buildRequest` is now available as `buildRequest1`.
diff --git a/http-streams.cabal b/http-streams.cabal
--- a/http-streams.cabal
+++ b/http-streams.cabal
@@ -1,6 +1,6 @@
-cabal-version:       >= 1.24
+cabal-version:       1.24
 name:                http-streams
-version:             0.8.5.5
+version:             0.8.6.1
 synopsis:            An HTTP client using io-streams
 description:
  /Overview/
@@ -17,11 +17,11 @@
 license-file:        LICENCE
 author:              Andrew Cowie <andrew@operationaldynamics.com>
 maintainer:          Andrew Cowie <andrew@operationaldynamics.com>
-copyright:           © 2012-2017 Operational Dynamics Consulting, Pty Ltd and Others
+copyright:           © 2012-2018 Operational Dynamics Consulting, Pty Ltd and Others
 category:            Web, IO-Streams
-tested-with:         GHC == 8.0.2
+tested-with:         GHC == 8.2.2, GHC == 8.4.2
 stability:           experimental
-homepage:            http://github.com/afcowie/http-streams/
+homepage:            https://github.com/afcowie/http-streams/
 bug-reports:         https://github.com/afcowie/http-streams/issues
 extra-source-files:  README.markdown CHANGELOG.markdown
                      tests/MockServer.hs
@@ -41,8 +41,8 @@
 build-type:          Custom
 
 custom-setup
-  setup-depends:     base >= 4,
-                     Cabal
+  setup-depends:     base >= 4.5,
+                     Cabal >= 1.24
 
 flag network-uri
    description: Get Network.URI from the network-uri package
@@ -52,14 +52,14 @@
   default-language:  Haskell2010
 
   build-depends:     attoparsec,
-                     base >= 4 && <5,
+                     base >= 4.5 && <5,
                      directory,
                      base64-bytestring,
                      blaze-builder >= 0.4,
                      bytestring,
                      case-insensitive,
                      io-streams >= 1.3 && < 1.6,
-                     HsOpenSSL >= 0.10.3.5,
+                     HsOpenSSL >= 0.11.2,
                      openssl-streams >= 1.1 && < 1.4,
                      mtl,
                      transformers,
@@ -73,11 +73,11 @@
     build-depends: network-uri < 2.6, network < 2.6
 
   hs-source-dirs:    lib
-  exposed-modules:   Network.Http.Client
-  other-modules:     Network.Http.Connection,
+  exposed-modules:   Network.Http.Client,
+                     Network.Http.Connection,
                      Network.Http.ResponseParser,
-                     Network.Http.Utilities,
                      Network.Http.Inconvenience
+  other-modules:     Network.Http.Utilities
 
   ghc-options:       -Wall
                      -Wwarn
@@ -128,7 +128,7 @@
                      http-common  >= 0.8.2,
                      http-streams
 
-  hs-source-dirs:    lib,tests
+  hs-source-dirs:    tests
   main-is:           check.hs
   other-modules:     TestSuite
                      MockServer
diff --git a/lib/Network/Http/Connection.hs b/lib/Network/Http/Connection.hs
--- a/lib/Network/Http/Connection.hs
+++ b/lib/Network/Http/Connection.hs
@@ -1,7 +1,7 @@
 --
 -- HTTP client for use with io-streams
 --
--- Copyright © 2012-2014 Operational Dynamics Consulting, Pty Ltd
+-- Copyright © 2012-2018 Operational Dynamics Consulting, Pty Ltd
 --
 -- The code in this file, and the program it is a part of, is
 -- made available to you by its authors as open source software:
@@ -13,6 +13,7 @@
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE DoAndIfThenElse    #-}
 {-# LANGUAGE OverloadedStrings  #-}
+{-# OPTIONS_HADDOCK hide, not-home #-}
 
 module Network.Http.Connection (
     Connection(..),
diff --git a/lib/Network/Http/Inconvenience.hs b/lib/Network/Http/Inconvenience.hs
--- a/lib/Network/Http/Inconvenience.hs
+++ b/lib/Network/Http/Inconvenience.hs
@@ -1,7 +1,7 @@
 --
 -- HTTP client for use with io-streams
 --
--- Copyright © 2012-2014 Operational Dynamics Consulting, Pty Ltd
+-- Copyright © 2012-2018 Operational Dynamics Consulting, Pty Ltd
 --
 -- The code in this file, and the program it is a part of, is
 -- made available to you by its authors as open source software:
@@ -14,7 +14,8 @@
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE MagicHash          #-}
 {-# LANGUAGE OverloadedStrings  #-}
-{-# OPTIONS -fno-warn-orphans  #-}
+{-# OPTIONS_GHC -fno-warn-orphans #-}
+{-# OPTIONS_HADDOCK hide, not-home #-}
 
 module Network.Http.Inconvenience (
     URL,
@@ -217,13 +218,14 @@
 -- @\"https:\/\/\"@ request using one of the convenience functions. It
 -- configures OpenSSL to use the default set of ciphers.
 --
--- On Linux systems, this function also configures OpenSSL to verify
--- certificates using the system certificates stored in @\/etc\/ssl\/certs@.
+-- On Linux, OpenBSD and FreeBSD systems, this function also configures
+-- OpenSSL to verify certificates using the system/distribution supplied
+-- certificate authorities' certificates
 --
 -- On other systems, /no certificate validation is performed/ by the
 -- generated 'SSLContext' because there is no canonical place to find
--- the set of system certificates. When using this library on a
--- non-Linux system, you are encouraged to install the system
+-- the set of system certificates. When using this library on such system,
+-- you are encouraged to install the system
 -- certificates somewhere and create your own 'SSLContext'.
 --
 {-
@@ -242,6 +244,9 @@
     SSL.contextSetVerificationMode ctx SSL.VerifyNone
 #elif defined __FREEBSD__
     SSL.contextSetCAFile ctx "/usr/local/etc/ssl/cert.pem"
+    SSL.contextSetVerificationMode ctx $ SSL.VerifyPeer True True Nothing
+#elif defined __OPENBSD__
+    SSL.contextSetCAFile ctx "/etc/ssl/cert.pem"
     SSL.contextSetVerificationMode ctx $ SSL.VerifyPeer True True Nothing
 #else
     fedora <- doesDirectoryExist "/etc/pki/tls"
diff --git a/lib/Network/Http/ResponseParser.hs b/lib/Network/Http/ResponseParser.hs
--- a/lib/Network/Http/ResponseParser.hs
+++ b/lib/Network/Http/ResponseParser.hs
@@ -1,7 +1,7 @@
 --
 -- HTTP client for use with io-streams
 --
--- Copyright © 2012-2014 Operational Dynamics Consulting, Pty Ltd
+-- Copyright © 2012-2018 Operational Dynamics Consulting, Pty Ltd
 --
 -- The code in this file, and the program it is a part of, is
 -- made available to you by its authors as open source software:
@@ -19,6 +19,7 @@
 {-# LANGUAGE CPP                #-}
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE OverloadedStrings  #-}
+{-# OPTIONS_HADDOCK hide, not-home #-}
 
 module Network.Http.ResponseParser (
     readResponseHeader,
diff --git a/lib/Network/Http/Utilities.hs b/lib/Network/Http/Utilities.hs
--- a/lib/Network/Http/Utilities.hs
+++ b/lib/Network/Http/Utilities.hs
@@ -1,7 +1,7 @@
 --
 -- HTTP client for use with io-streams
 --
--- Copyright © 2012-2014 Operational Dynamics Consulting, Pty Ltd
+-- Copyright © 2012-2018 Operational Dynamics Consulting, Pty Ltd
 --
 -- The code in this file, and the program it is a part of, is
 -- made available to you by its authors as open source software:
@@ -25,7 +25,8 @@
 {-# LANGUAGE OverloadedStrings  #-}
 {-# LANGUAGE Rank2Types         #-}
 {-# LANGUAGE UnboxedTuples      #-}
-
+{-# OPTIONS_HADDOCK hide, not-home #-}
+ 
 module Network.Http.Utilities (
     readResponseLine,
     readHeaderFields
