diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 750e89d..20d9c74 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -864,6 +864,10 @@
     const char **alpn_list;         /*!< ordered list of protocols          */
 #endif
 
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+    mbedtls_ssl_ticket_keys *ticket_keys;       /*!<  keys for ticket encryption */
+#endif /* MBEDTLS_SSL_SESSION_TICKETS */
+
     /*
      * Numerical settings (int then char)
      */
@@ -1055,13 +1059,6 @@
     const char *peer_cn;                /*!<  expected peer CN          */
 #endif /* MBEDTLS_X509_CRT_PARSE_C */
 
-    /*
-     * Support for generating and checking session tickets
-     */
-#if defined(MBEDTLS_SSL_SESSION_TICKETS)
-    mbedtls_ssl_ticket_keys *ticket_keys;       /*!<  keys for ticket encryption */
-#endif /* MBEDTLS_SSL_SESSION_TICKETS */
-
     int client_auth;                    /*!<  flag for client auth.   */
     int verify_result;                  /*!<  verification result     */
 
@@ -1928,14 +1925,14 @@
  *                 to allow generating the ticket encryption and
  *                 authentication keys.
  *
- * \param ssl      SSL context
+ * \param conf     SSL configuration
  * \param use_tickets   Enable or disable (MBEDTLS_SSL_SESSION_TICKETS_ENABLED or
  *                                         MBEDTLS_SSL_SESSION_TICKETS_DISABLED)
  *
  * \return         O if successful,
  *                 or a specific error code (server only).
  */
-int mbedtls_ssl_set_session_tickets( mbedtls_ssl_context *ssl, int use_tickets );
+int mbedtls_ssl_set_session_tickets( mbedtls_ssl_config *conf, int use_tickets );
 
 /**
  * \brief          Set session ticket lifetime (server only)
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index e91d13c..59fce95 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -189,11 +189,11 @@
 
     *tlen = 0;
 
-    if( ssl->ticket_keys == NULL )
+    if( ssl->conf->ticket_keys == NULL )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     /* Write key name */
-    memcpy( p, ssl->ticket_keys->key_name, 16 );
+    memcpy( p, ssl->conf->ticket_keys->key_name, 16 );
     p += 16;
 
     /* Generate and write IV (with a copy for aes_crypt) */
@@ -224,7 +224,7 @@
         state[i] = (unsigned char) pad_len;
 
     /* Encrypt */
-    if( ( ret = mbedtls_aes_crypt_cbc( &ssl->ticket_keys->enc, MBEDTLS_AES_ENCRYPT,
+    if( ( ret = mbedtls_aes_crypt_cbc( &ssl->conf->ticket_keys->enc, MBEDTLS_AES_ENCRYPT,
                                enc_len, iv, state, state ) ) != 0 )
     {
         return( ret );
@@ -237,7 +237,7 @@
 
     /* Compute and write MAC( key_name + iv + enc_state_len + enc_state ) */
     if( ( ret = mbedtls_md_hmac( mbedtls_md_info_from_type( MBEDTLS_MD_SHA256 ),
-                         ssl->ticket_keys->mac_key, 16,
+                         ssl->conf->ticket_keys->mac_key, 16,
                          start, p - start, p ) ) != 0 )
     {
         return( ret );
@@ -271,7 +271,7 @@
 
     MBEDTLS_SSL_DEBUG_BUF( 3, "session ticket structure", buf, len );
 
-    if( len < 34 || ssl->ticket_keys == NULL )
+    if( len < 34 || ssl->conf->ticket_keys == NULL )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
     enc_len = ( enc_len_p[0] << 8 ) | enc_len_p[1];
@@ -283,12 +283,12 @@
     /* Check name, in constant time though it's not a big secret */
     diff = 0;
     for( i = 0; i < 16; i++ )
-        diff |= key_name[i] ^ ssl->ticket_keys->key_name[i];
+        diff |= key_name[i] ^ ssl->conf->ticket_keys->key_name[i];
     /* don't return yet, check the MAC anyway */
 
     /* Check mac, with constant-time buffer comparison */
     if( ( ret = mbedtls_md_hmac( mbedtls_md_info_from_type( MBEDTLS_MD_SHA256 ),
-                         ssl->ticket_keys->mac_key, 16,
+                         ssl->conf->ticket_keys->mac_key, 16,
                          buf, len - 32, computed_mac ) ) != 0 )
     {
         return( ret );
@@ -303,7 +303,7 @@
         return( MBEDTLS_ERR_SSL_INVALID_MAC );
 
     /* Decrypt */
-    if( ( ret = mbedtls_aes_crypt_cbc( &ssl->ticket_keys->dec, MBEDTLS_AES_DECRYPT,
+    if( ( ret = mbedtls_aes_crypt_cbc( &ssl->conf->ticket_keys->dec, MBEDTLS_AES_DECRYPT,
                                enc_len, iv, ticket, ticket ) ) != 0 )
     {
         return( ret );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index f72a2c4..276a0da 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5120,13 +5120,13 @@
 /*
  * Allocate and initialize ticket keys
  */
-static int ssl_ticket_keys_init( mbedtls_ssl_context *ssl )
+static int ssl_ticket_keys_init( mbedtls_ssl_config *conf )
 {
     int ret;
     mbedtls_ssl_ticket_keys *tkeys;
     unsigned char buf[16];
 
-    if( ssl->ticket_keys != NULL )
+    if( conf->ticket_keys != NULL )
         return( 0 );
 
     tkeys = mbedtls_malloc( sizeof(mbedtls_ssl_ticket_keys) );
@@ -5136,15 +5136,15 @@
     mbedtls_aes_init( &tkeys->enc );
     mbedtls_aes_init( &tkeys->dec );
 
-    if( ( ret = ssl->f_rng( ssl->p_rng, tkeys->key_name, 16 ) ) != 0 )
-    {
-        ssl_ticket_keys_free( tkeys );
-        mbedtls_free( tkeys );
-        return( ret );
-    }
+    /* Temporary WIP! Using hardcoded keys. This is to remove the dependency
+     * on the RNG and allow puttint the keys in conf. Key generation will soon
+     * be move outside the main SSL module anyway. */
 
-    if( ( ret = ssl->f_rng( ssl->p_rng, buf, 16 ) ) != 0 ||
-        ( ret = mbedtls_aes_setkey_enc( &tkeys->enc, buf, 128 ) ) != 0 ||
+    memset( tkeys->key_name, 'x', 16 );
+    memset( tkeys->mac_key, 0x2a, 16 );
+    memset( buf, 0x2a, 16 );
+
+    if( ( ret = mbedtls_aes_setkey_enc( &tkeys->enc, buf, 128 ) ) != 0 ||
         ( ret = mbedtls_aes_setkey_dec( &tkeys->dec, buf, 128 ) ) != 0 )
     {
         ssl_ticket_keys_free( tkeys );
@@ -5152,14 +5152,7 @@
         return( ret );
     }
 
-    if( ( ret = ssl->f_rng( ssl->p_rng, tkeys->mac_key, 16 ) ) != 0 )
-    {
-        ssl_ticket_keys_free( tkeys );
-        mbedtls_free( tkeys );
-        return( ret );
-    }
-
-    ssl->ticket_keys = tkeys;
+    conf->ticket_keys = tkeys;
 
     return( 0 );
 }
@@ -5649,22 +5642,19 @@
 #endif /* MBEDTLS_SSL_RENEGOTIATION */
 
 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
-int mbedtls_ssl_set_session_tickets( mbedtls_ssl_context *ssl, int use_tickets )
+int mbedtls_ssl_set_session_tickets( mbedtls_ssl_config *conf, int use_tickets )
 {
-    ssl->conf->session_tickets = use_tickets;
+    conf->session_tickets = use_tickets;
 
 #if defined(MBEDTLS_SSL_CLI_C)
-    if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
+    if( conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
         return( 0 );
 #endif
 
     if( use_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
         return( 0 );
 
-    if( ssl->f_rng == NULL )
-        return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
-
-    return( ssl_ticket_keys_init( ssl ) );
+    return( ssl_ticket_keys_init( conf ) );
 }
 
 void mbedtls_ssl_set_session_ticket_lifetime( mbedtls_ssl_config *conf, int lifetime )
@@ -6562,10 +6552,10 @@
     }
 
 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
-    if( ssl->ticket_keys )
+    if( ssl->conf->ticket_keys )
     {
-        ssl_ticket_keys_free( ssl->ticket_keys );
-        mbedtls_free( ssl->ticket_keys );
+        ssl_ticket_keys_free( ssl->conf->ticket_keys );
+        mbedtls_free( ssl->conf->ticket_keys );
     }
 #endif
 
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index afaafc4..03ac1b3 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -1131,7 +1131,7 @@
                              opt.read_timeout );
 
 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
-    if( ( ret = mbedtls_ssl_set_session_tickets( &ssl, opt.tickets ) ) != 0 )
+    if( ( ret = mbedtls_ssl_set_session_tickets( &conf, opt.tickets ) ) != 0 )
     {
         mbedtls_printf( " failed\n  ! mbedtls_ssl_set_session_tickets returned %d\n\n", ret );
         goto exit;
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 5f5033a..e5fcfdf 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -1590,7 +1590,7 @@
 #endif
 
 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
-    if( ( ret = mbedtls_ssl_set_session_tickets( &ssl, opt.tickets ) ) != 0 )
+    if( ( ret = mbedtls_ssl_set_session_tickets( &conf, opt.tickets ) ) != 0 )
     {
         mbedtls_printf( " failed\n  ! mbedtls_ssl_set_session_tickets returned %d\n\n", ret );
         goto exit;