diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 3dd69a5..7bcba24 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -503,6 +503,49 @@
     fi
 }
 
+# Strip off a particular parameter from the command line
+# and return its value.
+# Parameter 1: Command line parameter to strip off
+# ENV I/O: CMD command line to search and modify
+extract_cmdline_argument() {
+    __ARG=$(echo "$CMD" | sed -n "s/^.* $1=\([^ ]*\).*$/\1/p")
+    CMD=$(echo "$CMD" | sed "s/$1=\([^ ]*\)//")
+}
+
+# Check compatibility of the ssl_client2/ssl_server2 command-line
+# with a particular compile-time configurable option.
+# Parameter 1: Command-line argument (e.g. extended_ms)
+# Parameter 2: Corresponding compile-time configuration
+#              (e.g. MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
+# ENV I/O: CMD command line to search and modify
+#          SKIP_NEXT set to "YES" on a mismatch
+check_cmdline_param_compat() {
+    __VAL="$( get_config_value_or_default "$2" )"
+    if [ ! -z "$__VAL" ]; then
+        extract_cmdline_argument "$1"
+        if [ ! -z "$__ARG" ] && [ "$__ARG" != "$__VAL" ]; then
+            SKIP_NEXT="YES"
+        fi
+    fi
+}
+
+# Go through all options that can be hardcoded at compile-time and
+# detect whether the command line configures them in a conflicting
+# way. If so, skip the test. Otherwise, remove the corresponding
+# entry.
+# Parameter 1: Command line to inspect
+# Output: Modified command line
+# ENV I/O: SKIP_TEST set to 1 on mismatch.
+check_cmdline_compat() {
+    CMD="$1"
+
+    # ExtendedMasterSecret configuration
+    check_cmdline_param_compat "extended_ms" \
+                               "MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET"
+    check_cmdline_param_compat "enforce_extended_master_secret" \
+                               "MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET"
+}
+
 # Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]]
 # Options:  -s pattern  pattern that must be present in server output
 #           -c pattern  pattern that must be present in client output
@@ -531,14 +574,6 @@
         SKIP_NEXT="YES"
     fi
 
-    # should we skip?
-    if [ "X$SKIP_NEXT" = "XYES" ]; then
-        SKIP_NEXT="NO"
-        echo "SKIP"
-        SKIPS=$(( $SKIPS + 1 ))
-        return
-    fi
-
     # does this test use a proxy?
     if [ "X$1" = "X-p" ]; then
         PXY_CMD="$2"
@@ -553,6 +588,12 @@
     CLI_EXPECT="$3"
     shift 3
 
+    check_cmdline_compat "$SRV_CMD"
+    SRV_CMD="$CMD"
+
+    check_cmdline_compat "$CLI_CMD"
+    CLI_CMD="$CMD"
+
     # Check if test uses files
     TEST_USES_FILES=$(echo "$SRV_CMD $CLI_CMD" | grep "\.\(key\|crt\|pem\)" )
     if [ ! -z "$TEST_USES_FILES" ]; then
@@ -1836,8 +1877,8 @@
 # Tests for Extended Master Secret extension
 
 run_test    "Extended Master Secret: default (not enforcing)" \
-            "$P_SRV debug_level=3" \
-            "$P_CLI debug_level=3" \
+            "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0 " \
+            "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
             0 \
             -c "client hello, adding extended_master_secret extension" \
             -s "found extended master secret extension" \
@@ -1847,8 +1888,8 @@
             -s "session hash for extended master secret"
 
 run_test    "Extended Master Secret: both enabled, both enforcing" \
-            "$P_SRV debug_level=3 enforce_extended_master_secret=1" \
-            "$P_CLI debug_level=3 enforce_extended_master_secret=1" \
+            "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
+            "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
             0 \
             -c "client hello, adding extended_master_secret extension" \
             -s "found extended master secret extension" \
@@ -1858,8 +1899,8 @@
             -s "session hash for extended master secret"
 
 run_test    "Extended Master Secret: both enabled, client enforcing" \
-            "$P_SRV debug_level=3 enforce_extended_master_secret=0" \
-            "$P_CLI debug_level=3 enforce_extended_master_secret=1" \
+            "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
+            "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
             0 \
             -c "client hello, adding extended_master_secret extension" \
             -s "found extended master secret extension" \
@@ -1869,8 +1910,8 @@
             -s "session hash for extended master secret"
 
 run_test    "Extended Master Secret: both enabled, server enforcing" \
-            "$P_SRV debug_level=3 enforce_extended_master_secret=1" \
-            "$P_CLI debug_level=3 enforce_extended_master_secret=0" \
+            "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
+            "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
             0 \
             -c "client hello, adding extended_master_secret extension" \
             -s "found extended master secret extension" \
@@ -1880,7 +1921,7 @@
             -s "session hash for extended master secret"
 
 run_test    "Extended Master Secret: client enabled, server disabled, client enforcing" \
-            "$P_SRV debug_level=3 extended_ms=0" \
+            "$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
             "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
             1 \
             -c "client hello, adding extended_master_secret extension" \
@@ -1891,7 +1932,7 @@
 
 run_test    "Extended Master Secret enforced: client disabled, server enabled, server enforcing" \
             "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=1" \
-            "$P_CLI debug_level=3 extended_ms=0" \
+            "$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
             1 \
             -C "client hello, adding extended_master_secret extension" \
             -S "found extended master secret extension" \
@@ -1900,8 +1941,8 @@
             -s "Peer not offering extended master secret, while it is enforced"
 
 run_test    "Extended Master Secret: client enabled, server disabled, not enforcing" \
-            "$P_SRV debug_level=3 extended_ms=0" \
-            "$P_CLI debug_level=3 extended_ms=1" \
+            "$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
+            "$P_CLI debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
             0 \
             -c "client hello, adding extended_master_secret extension" \
             -s "found extended master secret extension" \
@@ -1911,8 +1952,8 @@
             -S "session hash for extended master secret"
 
 run_test    "Extended Master Secret: client disabled, server enabled, not enforcing" \
-            "$P_SRV debug_level=3 extended_ms=1" \
-            "$P_CLI debug_level=3 extended_ms=0" \
+            "$P_SRV debug_level=3 extended_ms=1 enforce_extended_master_secret=0" \
+            "$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
             0 \
             -C "client hello, adding extended_master_secret extension" \
             -S "found extended master secret extension" \
@@ -1922,8 +1963,8 @@
             -S "session hash for extended master secret"
 
 run_test    "Extended Master Secret: client disabled, server disabled" \
-            "$P_SRV debug_level=3 extended_ms=0" \
-            "$P_CLI debug_level=3 extended_ms=0" \
+            "$P_SRV debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
+            "$P_CLI debug_level=3 extended_ms=0 enforce_extended_master_secret=0" \
             0 \
             -C "client hello, adding extended_master_secret extension" \
             -S "found extended master secret extension" \
@@ -1934,8 +1975,8 @@
 
 requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
 run_test    "Extended Master Secret: client SSLv3, server enabled" \
-            "$P_SRV debug_level=3 min_version=ssl3" \
-            "$P_CLI debug_level=3 force_version=ssl3" \
+            "$P_SRV debug_level=3 min_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
+            "$P_CLI debug_level=3 force_version=ssl3 extended_ms=1  enforce_extended_master_secret=0" \
             0 \
             -C "client hello, adding extended_master_secret extension" \
             -S "found extended master secret extension" \
@@ -1946,8 +1987,8 @@
 
 requires_config_enabled MBEDTLS_SSL_PROTO_SSL3
 run_test    "Extended Master Secret: client enabled, server SSLv3" \
-            "$P_SRV debug_level=3 force_version=ssl3" \
-            "$P_CLI debug_level=3 min_version=ssl3" \
+            "$P_SRV debug_level=3 force_version=ssl3 extended_ms=1 enforce_extended_master_secret=0" \
+            "$P_CLI debug_level=3 min_version=ssl3 extended_ms=1  enforce_extended_master_secret=0" \
             0 \
             -c "client hello, adding extended_master_secret extension" \
             -S "found extended master secret extension" \