diff --git a/warden_ra/ejbcaws.py b/warden_ra/ejbcaws.py
old mode 100644
new mode 100755
index c0a78f101ef436db7bd0c87c7d4ee4db8a7944fe..af63d991b6157c0081736afc7904119d80587213
--- a/warden_ra/ejbcaws.py
+++ b/warden_ra/ejbcaws.py
@@ -4,8 +4,7 @@
 # Copyright (c) 2016, CESNET, z. s. p. o.
 # Use of this source is governed by an ISC license, see LICENSE file.
 
-import urllib2
-import httplib
+import sys
 import socket
 import base64
 import suds.transport.http
@@ -13,6 +12,13 @@ import suds.client
 import M2Crypto
 
 
+if sys.version_info[0] >= 3:
+    import urllib.request as urllib2
+    import http.client as httplib
+else:
+    import urllib2
+    import httplib
+
 STATUS_FAILED = 11
 STATUS_GENERATED = 40
 STATUS_HISTORICAL = 60
diff --git a/warden_ra/warden_ra.py b/warden_ra/warden_ra.py
index b7400c355d8546b6846a89e2c7946e7f5e55b26b..af85ba86a999fb3aa0e812fd0c5da5ca7114cddb 100755
--- a/warden_ra/warden_ra.py
+++ b/warden_ra/warden_ra.py
@@ -4,6 +4,8 @@
 # Copyright (c) 2016, CESNET, z. s. p. o.
 # Use of this source is governed by an ISC license, see LICENSE file.
 
+from __future__ import print_function
+
 import sys
 import os
 import time
@@ -21,13 +23,17 @@ import subprocess
 import shlex
 import tempfile
 import M2Crypto
-import ConfigParser
 # *ph* server vulnerable to logjam, local openssl too new, use hammer to disable Diffie-Helmann
 import ssl
 ssl._DEFAULT_CIPHERS += ":!DH"
 
 import ejbcaws
 
+if sys.version_info[0] >= 3:
+    import configparser as ConfigParser
+else:
+    import ConfigParser
+
 # usual path to warden server
 sys.path.append(pth.join(pth.dirname(__file__), "..", "warden-server"))
 import warden_server
@@ -120,7 +126,7 @@ class OpenSSLRegistry(object):
         except OSError as e:
             if e.errno != errno.EEXIST:
                 raise
-        with tempfile.NamedTemporaryFile(dir=client_path, delete=False) as cf:
+        with tempfile.NamedTemporaryFile(dir=client_path, delete=False, mode="w") as cf:
             config.write(cf)
         os.chmod(cf.name, 0o660)    # read privilege for usual apache group
         os.rename(cf.name, pth.join(client_path, "state")) # atomic + rewrite, so no need for locking
@@ -309,7 +315,7 @@ class OptionalAuthenticator(ObjectBase):
             try:
                 args["password"][0]
                 return "pwd"    # Ok, pass on, but getCert will have to rely on certificate registry password
-            except KeyError, IndexError:
+            except (KeyError, IndexError):
                 exception = self.req.error(message="authenticate: no certificate nor password present", error=403, cn = cert_name, args = args)
                 exception.log(self.log)
                 return None
@@ -414,7 +420,7 @@ def list_clients(registry, name=None, verbose=False, show_cert=True):
     if name is not None:
         client = registry.get_client(name)
         if client is None:
-            print "No such client."
+            print("No such client.")
             return
         else:
             print(client.str(verbose))
@@ -442,14 +448,14 @@ def register_client(registry, name, admins=None, verbose=False):
 def applicant(registry, name, password=None, verbose=False):
     client = registry.get_client(name)
     if not client:
-        print "No such client."
+        print("No such client.")
         return
     if password is None:
         password = "".join((random.choice(string.ascii_letters + string.digits) for dummy in range(16)))
     try:
         client.update(status="Issuable", pwd=password)
     except ClientDisabledError:
-        print "This client is disabled. Use 'enable' first."
+        print("This client is disabled. Use 'enable' first.")
         return
     registry.save_client(client)
     list_clients(registry, name, verbose, show_cert=False)
@@ -459,7 +465,7 @@ def applicant(registry, name, password=None, verbose=False):
 def enable(registry, name, verbose=False):
     client = registry.get_client(name)
     if not client:
-        print "No such client."
+        print("No such client.")
         return
     client.update(status="Passive")
     registry.save_client(client)
@@ -469,7 +475,7 @@ def enable(registry, name, verbose=False):
 def disable(registry, name, verbose=False):
     client = registry.get_client(name)
     if not client:
-        print "No such client."
+        print("No such client.")
         return
     client.update(status="Disabled")
     registry.save_client(client)
diff --git a/warden_server/warden_server.py b/warden_server/warden_server.py
index c69fb6a7799d5de101d3ce8eb7fdb4071f24f19e..5cf1c093fb006e3c11750b7cfc62da548d7d7d1b 100755
--- a/warden_server/warden_server.py
+++ b/warden_server/warden_server.py
@@ -863,7 +863,7 @@ def expose(read=1, write=0, debug=0):
         meth.write = write
         meth.debug = debug
         if not hasattr(meth, "arguments"):
-            meth.arguments = meth.func_code.co_varnames[:meth.func_code.co_argcount]
+            meth.arguments = get_method_params(meth)
         return meth
 
     return expose_deco