diff --git a/scripts/windows_msbuild.bat b/scripts/windows_msbuild.bat
deleted file mode 100644
index 2bc6a51..0000000
--- a/scripts/windows_msbuild.bat
+++ /dev/null
@@ -1,20 +0,0 @@
-@rem Build and test Mbed TLS with Visual Studio using msbuild.
-@rem Usage: windows_msbuild [RETARGET]
-@rem   RETARGET: version of Visual Studio to emulate
-@rem             https://docs.microsoft.com/en-us/cpp/build/how-to-modify-the-target-framework-and-platform-toolset
-
-@rem These parameters are hard-coded for now.
-set "arch=x64" & @rem "x86" or "x64"
-set "cfg=Release" & @rem "Debug" or "Release"
-set "vcvarsall=C:\Program Files (x86)\Microsoft Visual Studio\2017\BuildTools\VC\Auxiliary\Build\vcvarsall.bat"
-
-if not "%~1"=="" set "retarget=,PlatformToolset=%1"
-
-@rem If the %USERPROFILE%\Source directory exists, then running
-@rem vcvarsall.bat will silently change the directory to that directory.
-@rem Setting the VSCMD_START_DIR environment variable causes it to change
-@rem to that directory instead.
-set "VSCMD_START_DIR=%~dp0\..\visualc\VS2017"
-
-"%vcvarsall%" x64 && ^
-msbuild /t:Rebuild /p:Configuration=%cfg%%retarget% /m mbedTLS.sln
diff --git a/tests/docker/bionic/Dockerfile b/tests/docker/bionic/Dockerfile
deleted file mode 100644
index e4c49fa..0000000
--- a/tests/docker/bionic/Dockerfile
+++ /dev/null
@@ -1,158 +0,0 @@
-# Dockerfile
-#
-# Purpose
-# -------
-# Defines a Docker container suitable to build and run all tests (all.sh),
-# except for those that use a proprietary toolchain.
-#
-# WARNING: this Dockerfile is no longer maintained! See
-# https://github.com/Mbed-TLS/mbedtls-test/blob/master/README.md#quick-start
-# for the set of Docker images we use on the CI.
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-ARG MAKEFLAGS_PARALLEL=""
-ARG MY_REGISTRY=
-
-FROM ${MY_REGISTRY}ubuntu:bionic
-
-
-ENV DEBIAN_FRONTEND noninteractive
-
-RUN apt-get update \
-    && apt-get -y install software-properties-common \
-    && rm -rf /var/lib/apt/lists
-
-RUN add-apt-repository -y ppa:team-gcc-arm-embedded/ppa
-
-RUN apt-get update \
-    && apt-get -y install \
-    # mbedtls build/test dependencies
-    build-essential \
-    clang \
-    cmake \
-    doxygen \
-    gcc-arm-none-eabi \
-    gcc-mingw-w64-i686 \
-    gcc-multilib \
-    g++-multilib \
-    gdb \
-    git \
-    graphviz \
-    lsof \
-    python \
-    python3-pip \
-    python3 \
-    pylint3 \
-    valgrind \
-    wget \
-    # libnettle build dependencies
-    libgmp-dev \
-    m4 \
-    pkg-config \
-    && rm -rf /var/lib/apt/lists/*
-
-# Jinja2 is required for driver dispatch code generation.
-RUN python3 -m pip install \
-    jinja2==2.10.1 types-jinja2
-
-# Build a static, legacy openssl from sources with sslv3 enabled
-# Based on https://gist.github.com/bmaupin/8caca3a1e8c3c5686141 (build-openssl.sh)
-# Note: openssl-1.0.2 and earlier has known build issues with parallel make.
-RUN cd /tmp \
-    && wget https://www.openssl.org/source/old/1.0.1/openssl-1.0.1j.tar.gz -qO- | tar xz \
-    && cd openssl-1.0.1j \
-    && ./config --openssldir=/usr/local/openssl-1.0.1j no-shared \
-    && (make ${MAKEFLAGS_PARALLEL} || make -j 1) \
-    && make install_sw \
-    && rm -rf /tmp/openssl*
-ENV OPENSSL_LEGACY=/usr/local/openssl-1.0.1j/bin/openssl
-
-# Build OPENSSL as 1.0.2g
-RUN cd /tmp \
-    && wget https://www.openssl.org/source/old/1.0.2/openssl-1.0.2g.tar.gz -qO- | tar xz \
-    && cd openssl-1.0.2g \
-    && ./config --openssldir=/usr/local/openssl-1.0.2g no-shared \
-    && (make ${MAKEFLAGS_PARALLEL} || make -j 1) \
-    && make install_sw \
-    && rm -rf /tmp/openssl*
-ENV OPENSSL=/usr/local/openssl-1.0.2g/bin/openssl
-
-# Build a new openssl binary for ARIA/CHACHA20 support
-# Based on https://gist.github.com/bmaupin/8caca3a1e8c3c5686141 (build-openssl.sh)
-RUN cd /tmp \
-    && wget https://www.openssl.org/source/openssl-1.1.1a.tar.gz -qO- | tar xz \
-    && cd openssl-1.1.1a \
-    && ./config --prefix=/usr/local/openssl-1.1.1a -Wl,--enable-new-dtags,-rpath,'${LIBRPATH}' no-shared \
-    && make ${MAKEFLAGS_PARALLEL} \
-    && make install_sw \
-    && rm -rf /tmp/openssl*
-ENV OPENSSL_NEXT=/usr/local/openssl-1.1.1a/bin/openssl
-
-# Build libnettle 2.7.1 (needed by legacy gnutls)
-RUN cd /tmp \
-    && wget https://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gz -qO- | tar xz \
-    && cd nettle-2.7.1 \
-    && ./configure --disable-documentation \
-    && make ${MAKEFLAGS_PARALLEL} \
-    && make install \
-    && /sbin/ldconfig \
-    && rm -rf /tmp/nettle*
-
-# Build legacy gnutls (3.3.8)
-RUN cd /tmp \
-    && wget https://www.gnupg.org/ftp/gcrypt/gnutls/v3.3/gnutls-3.3.8.tar.xz -qO- | tar xJ \
-    && cd gnutls-3.3.8 \
-    && ./configure --prefix=/usr/local/gnutls-3.3.8 --exec_prefix=/usr/local/gnutls-3.3.8 --disable-shared --disable-guile --disable-doc \
-    && make ${MAKEFLAGS_PARALLEL} \
-    && make install \
-    && rm -rf /tmp/gnutls*
-ENV GNUTLS_LEGACY_CLI=/usr/local/gnutls-3.3.8/bin/gnutls-cli
-ENV GNUTLS_LEGACY_SERV=/usr/local/gnutls-3.3.8/bin/gnutls-serv
-
-# Build libnettle 3.1 (needed by gnutls)
-RUN cd /tmp \
-    && wget https://ftp.gnu.org/gnu/nettle/nettle-3.1.tar.gz -qO- | tar xz \
-    && cd nettle-3.1 \
-    && ./configure --disable-documentation \
-    && make ${MAKEFLAGS_PARALLEL} \
-    && make install \
-    && /sbin/ldconfig \
-    && rm -rf /tmp/nettle*
-
-# Build gnutls (3.4.10)
-RUN cd /tmp \
-    && wget https://www.gnupg.org/ftp/gcrypt/gnutls/v3.4/gnutls-3.4.10.tar.xz -qO- | tar xJ \
-    && cd gnutls-3.4.10 \
-    && ./configure --prefix=/usr/local/gnutls-3.4.10 --exec_prefix=/usr/local/gnutls-3.4.10 \
-        --with-included-libtasn1 --without-p11-kit \
-        --disable-shared --disable-guile --disable-doc \
-    && make ${MAKEFLAGS_PARALLEL} \
-    && make install \
-    && rm -rf /tmp/gnutls*
-ENV GNUTLS_CLI=/usr/local/gnutls-3.4.10/bin/gnutls-cli
-ENV GNUTLS_SERV=/usr/local/gnutls-3.4.10/bin/gnutls-serv
-
-# Build libnettle 3.7.3 (needed by gnutls next)
-RUN cd /tmp \
-    && wget https://ftp.gnu.org/gnu/nettle/nettle-3.7.3.tar.gz -qO- | tar xz \
-    && cd nettle-3.7.3 \
-    && ./configure --disable-documentation \
-    && make ${MAKEFLAGS_PARALLEL} \
-    && make install \
-    && /sbin/ldconfig \
-    && rm -rf /tmp/nettle*
-
-# Build gnutls next (3.7.2)
-RUN cd /tmp \
-    && wget https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.2.tar.xz -qO- | tar xJ \
-    && cd gnutls-3.7.2 \
-    && ./configure --prefix=/usr/local/gnutls-3.7.2 --exec_prefix=/usr/local/gnutls-3.7.2 \
-        --with-included-libtasn1 --with-included-unistring --without-p11-kit \
-        --disable-shared --disable-guile --disable-doc \
-    && make ${MAKEFLAGS_PARALLEL} \
-    && make install \
-    && rm -rf /tmp/gnutls*
-
-ENV GNUTLS_NEXT_CLI=/usr/local/gnutls-3.7.2/bin/gnutls-cli
-ENV GNUTLS_NEXT_SERV=/usr/local/gnutls-3.7.2/bin/gnutls-serv
diff --git a/tests/scripts/all-in-docker.sh b/tests/scripts/all-in-docker.sh
deleted file mode 100755
index b2a31c2..0000000
--- a/tests/scripts/all-in-docker.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/bash -eu
-
-# all-in-docker.sh
-#
-# Purpose
-# -------
-# This runs all.sh (except for armcc) in a Docker container.
-#
-# WARNING: the Dockerfile used by this script is no longer maintained! See
-# https://github.com/Mbed-TLS/mbedtls-test/blob/master/README.md#quick-start
-# for the set of Docker images we use on the CI.
-#
-# Notes for users
-# ---------------
-# See docker_env.sh for prerequisites and other information.
-#
-# See also all.sh for notes about invocation of that script.
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-source tests/scripts/docker_env.sh
-
-# Run tests that are possible with openly available compilers
-run_in_docker tests/scripts/all.sh \
-    --no-armcc \
-    $@
diff --git a/tests/scripts/basic-in-docker.sh b/tests/scripts/basic-in-docker.sh
deleted file mode 100755
index 81ee8d6..0000000
--- a/tests/scripts/basic-in-docker.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/bash -eu
-
-# basic-in-docker.sh
-#
-# Purpose
-# -------
-# This runs sanity checks and library tests in a Docker container. The tests
-# are run for both clang and gcc. The testing includes a full test run
-# in the default configuration, partial test runs in the reference
-# configurations, and some dependency tests.
-#
-# WARNING: the Dockerfile used by this script is no longer maintained! See
-# https://github.com/Mbed-TLS/mbedtls-test/blob/master/README.md#quick-start
-# for the set of Docker images we use on the CI.
-#
-# Notes for users
-# ---------------
-# See docker_env.sh for prerequisites and other information.
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-source tests/scripts/docker_env.sh
-
-run_in_docker tests/scripts/all.sh 'check_*'
-
-for compiler in clang gcc; do
-    run_in_docker -e CC=${compiler} cmake -D CMAKE_BUILD_TYPE:String="Check" .
-    run_in_docker -e CC=${compiler} make
-    run_in_docker -e CC=${compiler} make test
-    run_in_docker programs/test/selftest
-    run_in_docker -e OSSL_NO_DTLS=1 tests/compat.sh
-    run_in_docker tests/ssl-opt.sh -e '\(DTLS\|SCSV\).*openssl'
-    run_in_docker tests/scripts/depends.py curves
-    run_in_docker tests/scripts/depends.py kex
-done
diff --git a/tests/scripts/components-configuration-x509.sh b/tests/scripts/components-configuration-x509.sh
index e8ef283..800d98e 100644
--- a/tests/scripts/components-configuration-x509.sh
+++ b/tests/scripts/components-configuration-x509.sh
@@ -11,9 +11,9 @@
 
 component_test_no_x509_info () {
     msg "build: full + MBEDTLS_X509_REMOVE_INFO" # ~ 10s
-    scripts/config.pl full
-    scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests
-    scripts/config.pl set MBEDTLS_X509_REMOVE_INFO
+    scripts/config.py full
+    scripts/config.py unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests
+    scripts/config.py set MBEDTLS_X509_REMOVE_INFO
     make CFLAGS='-Werror -O2'
 
     msg "test: full + MBEDTLS_X509_REMOVE_INFO" # ~ 10s
diff --git a/tests/scripts/docker_env.sh b/tests/scripts/docker_env.sh
deleted file mode 100755
index cfc98df..0000000
--- a/tests/scripts/docker_env.sh
+++ /dev/null
@@ -1,90 +0,0 @@
-#!/bin/bash -eu
-
-# docker_env.sh
-#
-# Purpose
-# -------
-#
-# This is a helper script to enable running tests under a Docker container,
-# thus making it easier to get set up as well as isolating test dependencies
-# (which include legacy/insecure configurations of openssl and gnutls).
-#
-# WARNING: the Dockerfile used by this script is no longer maintained! See
-# https://github.com/Mbed-TLS/mbedtls-test/blob/master/README.md#quick-start
-# for the set of Docker images we use on the CI.
-#
-# Notes for users
-# ---------------
-# This script expects a Linux x86_64 system with a recent version of Docker
-# installed and available for use, as well as http/https access. If a proxy
-# server must be used, invoke this script with the usual environment variables
-# (http_proxy and https_proxy) set appropriately. If an alternate Docker
-# registry is needed, specify MBEDTLS_DOCKER_REGISTRY to point at the
-# host name.
-#
-#
-# Running this script directly will check for Docker availability and set up
-# the Docker image.
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-
-# default values, can be overridden by the environment
-: ${MBEDTLS_DOCKER_GUEST:=bionic}
-
-
-DOCKER_IMAGE_TAG="armmbed/mbedtls-test:${MBEDTLS_DOCKER_GUEST}"
-
-# Make sure docker is available
-if ! which docker > /dev/null; then
-    echo "Docker is required but doesn't seem to be installed. See https://www.docker.com/ to get started"
-    exit 1
-fi
-
-# Figure out if we need to 'sudo docker'
-if groups | grep docker > /dev/null; then
-    DOCKER="docker"
-else
-    echo "Using sudo to invoke docker since you're not a member of the docker group..."
-    DOCKER="sudo docker"
-fi
-
-# Figure out the number of processors available
-if [ "$(uname)" == "Darwin" ]; then
-    NUM_PROC="$(sysctl -n hw.logicalcpu)"
-else
-    NUM_PROC="$(nproc)"
-fi
-
-# Build the Docker image
-echo "Getting docker image up to date (this may take a few minutes)..."
-${DOCKER} image build \
-    -t ${DOCKER_IMAGE_TAG} \
-    --cache-from=${DOCKER_IMAGE_TAG} \
-    --build-arg MAKEFLAGS_PARALLEL="-j ${NUM_PROC}" \
-    --network host \
-    ${http_proxy+--build-arg http_proxy=${http_proxy}} \
-    ${https_proxy+--build-arg https_proxy=${https_proxy}} \
-    ${MBEDTLS_DOCKER_REGISTRY+--build-arg MY_REGISTRY="${MBEDTLS_DOCKER_REGISTRY}/"} \
-    tests/docker/${MBEDTLS_DOCKER_GUEST}
-
-run_in_docker()
-{
-    ENV_ARGS=""
-    while [ "$1" == "-e" ]; do
-        ENV_ARGS="${ENV_ARGS} $1 $2"
-        shift 2
-    done
-
-    ${DOCKER} container run -it --rm \
-        --cap-add SYS_PTRACE \
-        --user "$(id -u):$(id -g)" \
-        --volume $PWD:$PWD \
-        --workdir $PWD \
-        -e MAKEFLAGS \
-        -e PYLINTHOME=/tmp/.pylintd \
-        ${ENV_ARGS} \
-        ${DOCKER_IMAGE_TAG} \
-        $@
-}
diff --git a/tests/scripts/tcp_client.pl b/tests/scripts/tcp_client.pl
deleted file mode 100755
index 9aff22d..0000000
--- a/tests/scripts/tcp_client.pl
+++ /dev/null
@@ -1,89 +0,0 @@
-#!/usr/bin/env perl
-
-# A simple TCP client that sends some data and expects a response.
-# Usage: tcp_client.pl HOSTNAME PORT DATA1 RESPONSE1
-#   DATA: hex-encoded data to send to the server
-#   RESPONSE: regexp that must match the server's response
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-use warnings;
-use strict;
-use IO::Socket::INET;
-
-# Pack hex digits into a binary string, ignoring whitespace.
-sub parse_hex {
-    my ($hex) = @_;
-    $hex =~ s/\s+//g;
-    return pack('H*', $hex);
-}
-
-## Open a TCP connection to the specified host and port.
-sub open_connection {
-    my ($host, $port) = @_;
-    my $socket = IO::Socket::INET->new(PeerAddr => $host,
-                                       PeerPort => $port,
-                                       Proto => 'tcp',
-                                       Timeout => 1);
-    die "Cannot connect to $host:$port: $!" unless $socket;
-    return $socket;
-}
-
-## Close the TCP connection.
-sub close_connection {
-    my ($connection) = @_;
-    $connection->shutdown(2);
-    # Ignore shutdown failures (at least for now)
-    return 1;
-}
-
-## Write the given data, expressed as hexadecimal
-sub write_data {
-    my ($connection, $hexdata) = @_;
-    my $data = parse_hex($hexdata);
-    my $total_sent = 0;
-    while ($total_sent < length($data)) {
-        my $sent = $connection->send($data, 0);
-        if (!defined $sent) {
-            die "Unable to send data: $!";
-        }
-        $total_sent += $sent;
-    }
-    return 1;
-}
-
-## Read a response and check it against an expected prefix
-sub read_response {
-    my ($connection, $expected_hex) = @_;
-    my $expected_data = parse_hex($expected_hex);
-    my $start_offset = 0;
-    while ($start_offset < length($expected_data)) {
-        my $actual_data;
-        my $ok = $connection->recv($actual_data, length($expected_data));
-        if (!defined $ok) {
-            die "Unable to receive data: $!";
-        }
-        if (($actual_data ^ substr($expected_data, $start_offset)) =~ /[^\000]/) {
-            printf STDERR ("Received \\x%02x instead of \\x%02x at offset %d\n",
-                           ord(substr($actual_data, $-[0], 1)),
-                           ord(substr($expected_data, $start_offset + $-[0], 1)),
-                           $start_offset + $-[0]);
-            return 0;
-        }
-        $start_offset += length($actual_data);
-    }
-    return 1;
-}
-
-if (@ARGV != 4) {
-    print STDERR "Usage: $0 HOSTNAME PORT DATA1 RESPONSE1\n";
-    exit(3);
-}
-my ($host, $port, $data1, $response1) = @ARGV;
-my $connection = open_connection($host, $port);
-write_data($connection, $data1);
-if (!read_response($connection, $response1)) {
-    exit(1);
-}
-close_connection($connection);
diff --git a/tests/scripts/travis-log-failure.sh b/tests/scripts/travis-log-failure.sh
deleted file mode 100755
index 3daecf3..0000000
--- a/tests/scripts/travis-log-failure.sh
+++ /dev/null
@@ -1,35 +0,0 @@
-#!/bin/sh
-
-# travis-log-failure.sh
-#
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-#
-# Purpose
-#
-# List the server and client logs on failed ssl-opt.sh and compat.sh tests.
-# This script is used to make the logs show up in the Travis test results.
-#
-# Some of the logs can be very long: this means usually a couple of megabytes
-# but it can be much more. For example, the client log of test 273 in ssl-opt.sh
-# is more than 630 Megabytes long.
-
-if [ -d include/mbedtls ]; then :; else
-    echo "$0: must be run from root" >&2
-    exit 1
-fi
-
-FILES="o-srv-*.log o-cli-*.log c-srv-*.log c-cli-*.log o-pxy-*.log"
-MAX_LOG_SIZE=1048576
-
-for PATTERN in $FILES; do
-    for LOG in $( ls tests/$PATTERN 2>/dev/null ); do
-        echo
-        echo "****** BEGIN file: $LOG ******"
-        echo
-        tail -c $MAX_LOG_SIZE $LOG
-        echo "****** END file: $LOG ******"
-        echo
-        rm $LOG
-    done
-done
diff --git a/tests/ssl-opt-in-docker.sh b/tests/ssl-opt-in-docker.sh
deleted file mode 100755
index c0c85fc..0000000
--- a/tests/ssl-opt-in-docker.sh
+++ /dev/null
@@ -1,55 +0,0 @@
-#!/bin/bash -eu
-
-# ssl-opt-in-docker.sh
-#
-# Purpose
-# -------
-# This runs ssl-opt.sh in a Docker container.
-#
-# WARNING: the Dockerfile used by this script is no longer maintained! See
-# https://github.com/Mbed-TLS/mbedtls-test/blob/master/README.md#quick-start
-# for the set of Docker images we use on the CI.
-#
-# Notes for users
-# ---------------
-# If OPENSSL, GNUTLS_CLI, or GNUTLS_SERV are specified, the path must
-# correspond to an executable inside the Docker container. The special
-# values "next" and "legacy" are also allowed as shorthand for the
-# installations inside the container.
-#
-# See also:
-# - scripts/docker_env.sh for general Docker prerequisites and other information.
-# - ssl-opt.sh for notes about invocation of that script.
-
-# Copyright The Mbed TLS Contributors
-# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
-
-source tests/scripts/docker_env.sh
-
-case "${OPENSSL:-default}" in
-    "legacy")  export OPENSSL="/usr/local/openssl-1.0.1j/bin/openssl";;
-    "next")    export OPENSSL="/usr/local/openssl-1.1.1a/bin/openssl";;
-    *) ;;
-esac
-
-case "${GNUTLS_CLI:-default}" in
-    "legacy")  export GNUTLS_CLI="/usr/local/gnutls-3.3.8/bin/gnutls-cli";;
-    "next")  export GNUTLS_CLI="/usr/local/gnutls-3.7.2/bin/gnutls-cli";;
-    *) ;;
-esac
-
-case "${GNUTLS_SERV:-default}" in
-    "legacy")  export GNUTLS_SERV="/usr/local/gnutls-3.3.8/bin/gnutls-serv";;
-    "next")  export GNUTLS_SERV="/usr/local/gnutls-3.7.2/bin/gnutls-serv";;
-    *) ;;
-esac
-
-run_in_docker \
-    -e P_SRV \
-    -e P_CLI \
-    -e P_PXY \
-    -e GNUTLS_CLI \
-    -e GNUTLS_SERV \
-    -e OPENSSL \
-    tests/ssl-opt.sh \
-    $@
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 2750fa9..0376018 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -68,7 +68,6 @@
 O_CLI="echo 'GET / HTTP/1.0' | $OPENSSL s_client"
 G_SRV="$GNUTLS_SERV --x509certfile $DATA_FILES_PATH/server5.crt --x509keyfile $DATA_FILES_PATH/server5.key"
 G_CLI="echo 'GET / HTTP/1.0' | $GNUTLS_CLI --x509cafile $DATA_FILES_PATH/test-ca_cat12.crt"
-TCP_CLIENT="$PERL scripts/tcp_client.pl"
 
 # alternative versions of OpenSSL and GnuTLS (no default path)